TenFourFox[1] continues to be maintained through community effort, and receives regular security fixes/backports. The problem is not software (although the project desperately lacks manpower), but the 20yro single-core CPU that literally sweats to push the crypto (let alone the CSS&JS).

Don't get me wrong. The relentless push for TLS is good, and I'm not arguing to take a step back - that would be insane. The change I'm asking for is, rather than doing [2] in your nginx.conf, do [3]. It doesn't change anything at all for modern browsers (when you hit that path, you're already at the mercy of an intercepting proxy), but makes your site more accessible for my ancient junk ;)

[1]: https://github.com/classilla/tenfourfox

[2]:

    return 301 https://$host$request_uri;

    if ($http_upgrade_insecure_requests = "1") {
        return 301 https://$host$request_uri;
    }