not really hard but a limit of HSTS in this particular scenario is that it doesn't automatically redirect you to https if it is the first visit to the web site,

not really hard but a limit of HSTS in this particular scenario is that it doesn't automatically redirect you to https if it is the first visit to the web site, which means if the http channel is compromised (the scenario calls for MTM) the hsts can't do anything to fix it (you can simply strip the 302 locations or tell the server that the other endpoint is talking https). only returning visitor will be redirected client side and only if they saw at some point the HSTS header over https.