But if they knew what's being requested, then the privacy would not be a part of the system. Unless the whole request was preceded by some signed hash of the request+headers that the cache could use for identification... Then again by doing mitm you could maybe poison the cache with a known content having the same hash (depends on the complexity of solution of course).
What I meant is that if it has to be sent outside of the protected stream, it could be also exchanged with mitm. Unless the hash itself is somehow related to the stream in a visible way. That kind of implementation complexity, rather than the signature/hash complecity.
That seems to get really complicated quite fast.