Thanks for these performance links, they're great. > Not necessarily. Consider HSTS, HPKP, Expect-CT, etc. Yeah, I'm aware of those (and use them on my own si

Thanks for these performance links, they're great. > Not necessarily. Consider HSTS, HPKP, Expect-CT, etc. Yeah, I'm aware of those (and use them on my own site) but the reality is that the vast majority of content sites out there do not use HPKP. Even if they use HSTS, many do not pre-load and as a worst case scenario the MITM can just switch the domain to something like google.unsecure.com or something like that.