If Globalsign starts sending bad OCSP data again, or your browser vendor blacklists your CA due to bad behavior from the CA (no fault of your own), you'll end u

If Globalsign starts sending bad OCSP data again, or your browser vendor blacklists your CA due to bad behavior from the CA (no fault of your own), you'll end up with a site that now can't be accessed at all That's only true for somewhat carelessly configured HPKP. With HSTS you can use any valid certificate. So all you need is obtain a certificate from another vendor. With Let's Encrypt, this will take you fifteen minutes tops. A careful administrator deploying HPKP would probably pin a key they have securely stored somewhere and, should a disaster strike, go out and buy a certificate for that pinned key. Again, that would take an hour at a cost probably lower than his lunch.