If a site uses key pinning (e.g. via HPKP), the site is in control of telling you which keys are acceptable, so there would be no way to pretend it's a routine

If a site uses key pinning (e.g. via HPKP), the site is in control of telling you which keys are acceptable, so there would be no way to pretend it's a routine rotation after your first site visit (unless the site is cooperating, in which case you're screwed anyway). Certificate Transparency would also help here, as it would allow site owners to monitor the logs for any certificates they did not request. This is more about detection as opposed to prevention (though the chilling effect of easier detection would help with prevention, I suppose). Admittedly, this is probably something only a couple of large, security-conscious organizations do (like, for example, Facebook, which detected that someone was issuing certificates against internal policy, though not maliciously in that case).