Killing off HTTP completely is simply not going to happen, and in the meantime using HSTS does confer a tangible and real security benefit. Regardless of wheth

Killing off HTTP completely is simply not going to happen, and in the meantime using HSTS does confer a tangible and real security benefit. Regardless of whether we can kill of HTTP, this argument that “optional security is not security” is completely facile. For example, I could write my own browser right now that doesn’t verify TLS certs. Does that make HTTPS’ authentication “not security”? The real question is what proportion of clients _do_ honour HSTS, and the answer to that is “most”.