You can always monitor for any time a cert is issued on your own domains. Couple that with Expect-CT and you have something as good as HKPK, without the downsid

You can always monitor for any time a cert is issued on your own domains. Couple that with Expect-CT and you have something as good as HKPK, without the downside. (Disclaimer: I run an open source monitoring project)