The article makes some good points, but I don't believe the risk of malicious pins has any effect on adoption. It doesn't really matter whether your site curren

The article makes some good points, but I don't believe the risk of malicious pins has any effect on adoption. It doesn't really matter whether your site currently uses HPKP or not - the attack works either way, as long as the user agent supports HPKP. Once an attacker has compromised your server in a way that allows them to add arbitrary HTTP headers, you're doomed. That's not to say that things like RansomPKP aren't problems worth thinking about, but when it comes to adoption, time would probably better be spent improving tooling and documentation.