Your disagreement seems to be with the spec for HSTS, which does say it should prevent showing a site with HTTP or with an invalid cert. https://datatracker.ie

Your disagreement seems to be with the spec for HSTS, which does say it should prevent showing a site with HTTP or with an invalid cert. https://datatracker.ietf.org/doc/html/rfc6797#section-12.1 https://datatracker.ietf.org/doc/html/rfc6797#section-12.1