"Shun" isn't the right word to use. The tools for managing SSL keys are abysmal, the documentation around HPKP so far is confusing (this article does a decent j

"Shun" isn't the right word to use. The tools for managing SSL keys are abysmal, the documentation around HPKP so far is confusing (this article does a decent job of explaining how to use it), and the impact of any mistake is that your site might become completely inaccessible to your customers. The best example this article could give (github) uses HPKP in the most conservative possible way. That should tell you something. As falcolas says, security is about risk tradeoffs. Right now the risk of using HPKP is rightly judged by most webmasters to be far greater than the risk of not using it. Key pinning Is a great security tool in many scenarios but for most public websites, it's not worth the risk.