It seems that Google does public key pinning, but possibly only through preloaded lists in browsers such as Chrome and Firefox. This blog post mentions them cat

It seems that Google does public key pinning, but possibly only through preloaded lists in browsers such as Chrome and Firefox. This blog post mentions them catching a bogus google.com cert from a trusted root https://security.googleblog.com/2015/03/maintaining-digital-certificate-security.html https://security.googleblog.com/2015/03/maintaining-digital-... This says Google does use HPKP, but I don't see headers myself. https://calomel.org/http_public_key_pinning_hpkp.html https://calomel.org/http_public_key_pinning_hpkp.html