Normalizing the values used in Vary at the CDN level is definitely the right way to go. However, that still leaves problems with transparent proxies at large companies, ISPs, mobile carriers, etc. unless you also have something like Cache-Control:private which is correctly handled.