If I understood correctly, we're basically talking about integrating the functionality described here into Oragono itself: darwin-network/slash#5
- Designate one or more plaintext listeners as "redirect-only"
- When clients connect to them, Oragono serves an STS policy (via
CAP LS) plus some human-readable text about how it's necessary to reconnect via TLS