Moving on from what we were saying about a caching/forwarding proxy, wouldn't support for ICAP devices be great!
So if a customer has already forked out for an ICAP security device, untangle could forward web-traffic there for scanning.
Squid-3-dev has support for ICAP in it. I don't know how complex it is but it seems to just be a bit of header exchange on port 1344.