OE provides unauthenticated encryption over TLS for data that would otherwise be
carried via clear text. This creates some confidentiality in the face of passive
eavesdropping,
You should never assume that 'eavesdropping' is passive. In almost every practical context of traffic interception, if you can read the transmission, you can write as well. If you're going to the trouble of installing some kind of tap, it makes more sense to make it read-write so you can actually do something with that intercepted connection. Collecting data is great, but hijacking is even better. and also provides you much better integrity protection for your data than raw
TCP does when dealing with random network noise
This is a red herring, and if you need real integrity is totally useless since it doesn't prevent an active attacker from corrupting the data once they've hijacked your unauthenticated connection. For the majority of plaintext traffic, a small amount of corruption is way more efficient to allow for than breaking down and re-creating a connection every time a single bit gets flipped.To use OE, you have to set up an SSL service in the first place, so just take the extra 15 minutes and make a real signed certificate. There is no such thing as "kind of" secure, after all. Encryption is intended to provide security. OE is not secure.