I'm bucketing User-Agents by device using something like varnish-devicedetect and storing the result in X-UA-Device on the request and the response.
I've seen several recommendations to vary on User-Agent. Any reason not to vary instead on X-UA-Device? Seems like it'd be nicer to downstream caches.
Since X-UA-Device is not available on the client request or in any downstream proxys (it's generated inside Varnish) you have to vary on the raw User-Agent header.