So we need some brave people to put tests on their server and block anyone using a client that responds to this authentication.

Sadly, for most people, there's no site that isn't run by a FANG that they know exists. Maybe we need to put the blocks in Apache and nginx instead.