You don't really have much of a guarantee about anything from the client when they make a request. You have to take them at good faith when they report a user-agent to you. Plus, from real-world experimentation, I'm relatively confident that the performance benefits of the solution I mentioned outweigh the cost of supporting browsers that spoof their user agents:
https://news.ycombinator.com/item?id=23662405