Third option: You deploy TLS 1.3, the middleboxes break, but that's neither your fault nor your problem. Hopfully they're makers or users will learn from this and not make respectively buy broken garbage. All major browser vendors appear to be involved with TLS 1.3.