I see this as a problem that is irreconcilable. Just because you add a header does not mean it will be respected, and the kind of folks who are willing to do ethically bizarre stuff like modify the page in flight are not likely to be stopped by saying please in the headers.
Better to focus on https which cannot be modified in flight this is the correct technical solution, not this kind of sporadically supported “say please” band aid.