Defaulting to key rotation for each renewal is a sane choice for most ACME clients. There is no enforcement of this on the CA side of things, so HPKP deployment

Defaulting to key rotation for each renewal is a sane choice for most ACME clients. There is no enforcement of this on the CA side of things, so HPKP deployment is possible regardless. The vast majority of sites should probably not use HPKP. Those sites will benefit from key rotation, and defaulting to anything else would make them less secure in a Heartbleed-like event. Client support for opting out of key rotation is a different matter. Many clients already offer this, just like certbot does with --csr, but that's very annoying to use. IIRC certbot has an open PR that adds key reuse support during renewal.