How are pinned Public Keys updated when the host changes keys? Say a user visits a website for the first time and the site's key is pinned in their browser. Th

How are pinned Public Keys updated when the host changes keys? Say a user visits a website for the first time and the site's key is pinned in their browser. Then the user doesn't visit for a long time and the pinned key expires. Later, the user visits again but now the pinned key is no longer being used. What should happen? According to the document: > The UA MUST ignore any expired Known Pinned Hosts in its cache. This is unfortunate, since the point of pinning keys is to minimize the risk of hijacked CAs down to the very first connection. With this system that risk occurs every time the key expires, and with several pushes to shorten the expiry times of public keys this could be quite often. In the example above, could the expired key be used to sign the new one? It wouldn't be used to secure the connection, but only to update the pinned key, where the chain of trust is unbroken from that very first visit.