Isn't keeping 3rd party stuff like TLS out of the core protocol a good thing? Regarding breaking existing clients in a catastrophic way, I think the server could send an error response to the client that don't support TLS (which is defined in the protocol so the clients should understand the error) if it doesn't want to serve some content without encryption or serve content over port 70 over plain text otherwise? I don't see why old clients are a show stopper there.