Cloudflare and Fastly should step up and add this header for all domains by default. That would probably be enough to kill this idiotic mal-feature.