From the introduction of the I-D: Key pinning is a trust-on-first-use (TOFU) mechanism. The first time a UA connects to a host, it lacks the information

From the introduction of the I-D: Key pinning is a trust-on-first-use (TOFU) mechanism. The first time a UA connects to a host, it lacks the information necessary to perform Pin Validation; UAs can only apply their normal cryptographic identity validation. (In this document, it is assumed that UAs apply X.509 certificate chain validation in accord with [RFC5280].) The UA will not be able to detect and thwart a MITM attacking the UA's first connection to the host. (However, the requirement that the MITM provide an X.509 certificate chain that can pass the UA's validation requirements, without error, mitigates this risk somewhat.) Worse, such a MITM can inject its own PKP header into the HTTP stream, and pin the UA to its own keys. To avoid post facto detection, the attacker would have to be in a position to intercept all future requests to the host from that UA. Thus, key pinning as described in this document is not a perfect defense against MITM attackers capable of passing certificate chain validation procedures -- nothing short of pre-shared keys can be. I think for most of us, this is still a big improvement. But for people under repressive regimes, isn't there a high chance that you get the MITM great-firewall-of-wherever the first time, and then you're stuck with it from then onwards even if you can tunnel out at some later time (this is assuming the government has control over at least one CA)?