In the end I configured my (pfSense) router to forward all data on port 80 (and a small selection of other commonly unencrypted ports) through a VPN to a local VPS. Port 443 HTTPS is still allowed to connect directly.
Makes me feel a lot better. Comcast should be a dumb pipe, not fucking with my data.
Turns out to get rid of that, I just had to call them and complain about it; they pretended to be surprised and asked me for details, but after the phone call the injection stopped. Worked for other people too.
What router do you have? Is it just something running OpenWRT, or something fancier? Also, how much do you pay beyond the listed service price (fees, taxes, etc), and can you waive the installation fee?
When I signed up there was no installtion fee, and no problem doing a self-install. But this was years so, so I have no idea if things have changed or not.
I might have to pick one up and see if I can get more SATA through the mini PCIe and have to be a storage server that also routes traffic. I've been hoping for an ARM chip, but with ECC, this might just win out.