Question: how does it work if user goes to the page which has invalid / self-signed certificate? Does proxy sign the altered page with the same certificate as others, thus making the warning go away? This would leave you open to other parties' MITM attacks too (because warnings are silently ignored).

Or do they leave the page intact if the page certificate is not legit?