https:// https:// with no extra options is still very much prone to downgrade/stripping attacks, and first-time connections to an https:// https:// site are par

https:// https:// with no extra options is still very much prone to downgrade/stripping attacks, and first-time connections to an https:// https:// site are particularly vulnerable since a lot of the extra hardening options (HSTS in particular) can be nullified through TOFU.