Yes, but that's most sites. This leaves an attack vector against people doing first-time-ever connections (like fresh installs of new OSes that are grabbing th

Yes, but that's most sites. This leaves an attack vector against people doing first-time-ever connections (like fresh installs of new OSes that are grabbing their new security packages), but TACK pins can also be pre-loaded or shared between clients for those circumstances.