The main reason not to use HPKP is it only protects people who have already connected. There are a hundred ways to force a new user agent or device to connect,

The main reason not to use HPKP is it only protects people who have already connected. There are a hundred ways to force a new user agent or device to connect, and then poof, compromised. Pinning is a great way for companies like Google to use Chrome to detect when someone has deployed an illegally issued certificate on their behalf. But for a company that hasn't bundled its keys with browsers, the user will just spin up a different browser and go to the compromised site, since HPKP is browser/session specific. HPKP is a toothless mitigation. We need better measures.