1: A server using HPKP with the reporting feature turned on will receive reports from browsers when the certificate does not match what was expected (provided H

1: A server using HPKP with the reporting feature turned on will receive reports from browsers when the certificate does not match what was expected (provided HPKP is being honored). 2: Browsers ignore HPKP when the server certificate is trusted through a user or administrator installed root CA. All mainstream browsers on all platforms behave in this way. This is by design specifically to allow enterprises to do the sort of traffic interception that Kazakhstan is implementing. The rationale is that if an attacker is able to get as far as installing their own CA on your system, you're screwed anyway.