Ransom in the sense that if you can hijack the DNS resolution for a website and set HPKP, you can then ransom the keys back to the legitimate owner. Or just des

Ransom in the sense that if you can hijack the DNS resolution for a website and set HPKP, you can then ransom the keys back to the legitimate owner. Or just destroy them and enjoy the damage. Imagine a domain squatter who grabs a domain, and sells it off, but set HPKP with a really long expiration. It needs to be strict to provide any security benefit, but that same strictness inherently allows it to be weaponized to deny legitimate access. UX and policy in the future will become more nuanced to mitigate the potential damage.