The first thing that comes to mind is setting the server to only accept SSL connections on the relevant pages and not allow HTTP connections. This should defeat the server sending anything sensitive back to the user in the clear, but ultimately isn't going to stop an active MITM that can make an insecure connection to the user but then convert it to an SSL connection from the attacker to the server.
Ultimately I'm not sure if there is a whole lot more that can be done than that though since without a mechanism to inform the client that they shouldn't send stuff in the clear, they are going to accept whatever they are told.
This brings up another point, I don't know a whole lot about HSTS but it seems like an active attacker that can prevent direct communication between the host and client could also simply strip the HSTS since HTTPS isn't normally used with a client certificate. The user would not see a secure connection to begin with, but if we aren't trusting the user to know what should or shouldn't be HTTPS, then really, it probably wouldn't be much of a stretch for anything we could add checking for HTTPS to be stripped as well.