AFAIU the difference between TACK and HPKP is: - For TACK, the pinned key is a custom key created just for that, and is transmitted in TLS - For HPKP, the pi

AFAIU the difference between TACK and HPKP is: - For TACK, the pinned key is a custom key created just for that, and is transmitted in TLS - For HPKP, the pinned key is a CA cert key (one of the CA on the chain), and is transmitted in HTTP I think pinning the CA cert key makes more sense, because this is what they were created for: certs certify, the matter is in how you transport them. OTOH putting all the pinning information directly in the certificate makes more sense to me. We should have every domain owner running its own CA, with a cert that has all required pinning data, signing all TLS keys of the servers, and then sending the minimal chain "server cert" <- "CA cert", and then browsers would pin that cert.