Don't you only need to be 51% confident? As long as fewer than 50% of all HTTP requests are modified by malicious adversaries in transit, you'd still have to pay up.