The 3rd and 4th step will break a lot of compatibility.

But requiring TLS1.2 works with any browser shipped in 2011 or later. I'm betting way less than 1% of usersgents these days cannot do TLS 1.2.