I'm of a different mindset than to believe that this can be legislated away or fixed in any part of the transit. We need to work toward (and we have nearly achieved) a situation where our endpoints are strong and intelligent enough that no manipulation of this sort is possible.
This issue is entirely about connecting to an untrusted endpoint. No endpoint-based solution is possible. This has to be dealt with by ensuring that the transit provider won't sell you out.