I feel any mention of HTTP Public Key Pinning should have the words "WARNING" surrounding it. It can take down your site if you screw it up - https://www.smash

I feel any mention of HTTP Public Key Pinning should have the words "WARNING" surrounding it. It can take down your site if you screw it up - https://www.smashingmagazine.com/be-afraid-of-public-key-pinning/ https://www.smashingmagazine.com/be-afraid-of-public-key-pin... I also believe it is one of the more difficult security features to implement & doesn't work well with Let's Encrypt https://community.letsencrypt.org/t/hpkp-best-practices-if-you-choose-to-implement/4625 https://community.letsencrypt.org/t/hpkp-best-practices-if-y... I'm not against it and this case does seem to make me reconsider my prior risk balance assessment of implementing it.