I have recently been reading up on the capabilities of TMG HTTPS inspection
The theory behind the use cases sounds fine (you want to stop mal-ware from being downloaded from HTTPS sites)
But basically TMG is acting as a "Man in the Middle" attack.
Depending on how your work domain is setup, this can all happen without the user even being told that their HTTPS traffic is being inspected. So much for privacy.
All the work domain needs to do is enforce a group policy with a trusted root certficates for the self signed TMG certs.
Does the browser report that the HTTPS is not valid?