Nobody is sending anything sensitive over the internet without TLS. AND proxies subject to poisoning are extremely rare. The masking requirement is simply poor engineering.