Cache-Control response header includes "private" Why does a vanilla Drupal 8 site add cache-control: must-revalidate, no-cache, private to all the pages?

A Drupal 7 site adds cache-control: must-revalidate, no-cache.

Is that addition of private for Drupal 8 somehow configurable? I'd like to not have it there.

It turns out that this response header in Drupal 8 is sent when system.performance:cache.page.max_age is set to 0. Setting it to anything greater than 0 (e.g 123) gives me max-age=123, public. The question still remains: Is there a way to get must-revalidate, no-cache?

The reason I want must-revalidate, no-cache without private is that I want browsers to always make requests for pages, and my cache server (fastly) to cache the content. Having private in the response headers bypasses fastly as per their documentation: https://docs.fastly.com/en/guides/cache-control-tutorial#do-not-cache
This is caused by symfony. private is added via vendor/symfony/http-foundation/ResponseHeaderBag.php and as far as I understand it's not possible to not have it when system.performance:cache.page.max_age is set to 0:

protected function computeCacheControlValue() {
  // ...
  if (!isset($this-&gt;cacheControl['s-maxage'])) {
    return $header.', private';
  }


Since I don't want to hack symfony, I can remove private via apache mod_header:

Header edit Cache-Control "(, )?private" ""