Other issues on salesforce.com appear to be that reports are prone to generating a TCP timeout error from the web gateway (so I"ll apparently need to tweak whatever the default tcp timeout it to get it working).
I believe I've narrowed down the Outlook plugin installer problem to Try-auth somehow. Bypass AV didn't work, bypassing additionally SSL inspection brought no joy, bypassing composite opener and friends failed to help, so assumably, something in the try auth rule is causing the issue since dropping this site into the global whitelst made the pain go away.
Anyone else have salesforce in their environment? Curious to know why you might not have an issue. At this particular client, strong egress filtering exists so they only way out is through this explicit proxy.