I think it's actually related to SSL.
/usr/share/doc/apache2/examples/ssl.conf (and my ssl.conf) contains:
SetEnvIf User-Agent ".*MSIE.*" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
Is this necessary at all?
If so, does this need to apply to non-SSL connections too?