HTTP/2 makes it clear that headers should be lower-case (https://datatracker.ietf.org/doc/html/rfc7540#section-8.1.2):

Just as in HTTP/1.x, header field names are strings of ASCII characters that are compared
in a case-insensitive fashion. However, header field names MUST be converted to lowercase
prior to their encoding in HTTP/2. A request or response containing uppercase header field
names MUST be treated as malformed (Section 8.1.2.6).

HTTP/1 was often case-preserving/case-insensitive. However, sometimes this behaviour caused bugs when different implementations worked together. So, it's quite a risky default.

I suggest with Rack 3.0 we take the opportunity to enforce the HTTP/2 semantics. It also simplifies the requirements around headers being a hash, to the point where I think it would be acceptable for Rack 3.0.

In terms of implementation it would require:

• Rack::Lint validates response headers should be lower case.
• All header key string constants are changed to lower case.
• Rework/remove Rack::HeaderHash.