See the no-cache case above.

Our internal docs actually suggest:

  Cache-Control: public, max-age=31536000

instead of the reverse above, so we might want to change this.  But IIRC public is needed to let proper HTTP 1.1 proxies know its OK to cache this content for all users of the proxy, not just the original requester.

If a proxy isn't able to honor this, its a busted proxy and is going to be doomed to fetching content it could have served from cache.  That's less of an issue than above with the no-cache case where a busted proxy might serve a cached result when it wasn't supposed to.