Breaking: Cisco announced end-of-sale for the virtual appliance. What's next?

Just saw the announcement about the Cisco Umbrella VA end-of-sale. It was our primary deployment method for a few key on-prem apps that couldn't use the roaming client.

Now I'm looking at the options and it's a bit of a puzzle. The obvious path is migrating to the DNS-layer client or the roaming client, but that's not a drop-in replacement for everything. The Secure Internet Gateway (SIG) virtual appliance seems like the intended successor, but it's a different beast.

Has anyone else been relying on the virtual appliance? What's your migration plan looking like? I'm especially curious about handling legacy systems that need explicit proxy settings.