Nothing? The ruling is that app developers get to choose how they communicate to users, or how they charge in-app fees. The kind of shady developers you describe would simply continue to use Apple, as it benefits them to do so.
It was in step #1. Most knative tutorials we found have you set up istio, which was the one setting the headers. There was separate work to rip out istio (which did not scale well either) that we didn't include in the post.
So istio used to sit between our proxy and knative's proxy. In order to figure out what headers it was setting, we ran a caddy container as a sidecar to the activator, and had it output the request metadata. We then read the code to confirm
Hi there, my name is on the post!
The CPU graph was a 500 (second) drop in the sum of CPU usage of kube-proxy pods alone. I think this is okay to disclose (we took out most y axes during final edits, this one seems to be a collateral).
You're right about the flattening - since this work, we've taken out the pieces of knative we really needed. Right again about embedding some of those pieces in our L7 proxy.
We didn't upstream the changes because we feel our use case is atypical - all KServices (Knative Services) only ever had one pod. This constraint enabled most of the simplifications we were able to make.
On the last point - so do we!