Worth commenting why we don't add an integrity-protected=no header?  (It doesn't mean what you might think it means.)