One thing I haven't necessarily seen raised is that including subdomains on HSTS headers would also affect internal websites on the same domain. I'd argue that

One thing I haven't necessarily seen raised is that including subdomains on HSTS headers would also affect internal websites on the same domain. I'd argue that it's a good reason/way to get all internal sites upgraded to HTTPS but it might not be feasible for a large organization. So something to consider.