HSTS is designed to protect against downgrading from HTTPS to HTTP. Best I can tell, it doesn't protect against downgrading from an HTTPS with a validated certi

HSTS is designed to protect against downgrading from HTTPS to HTTP. Best I can tell, it doesn't protect against downgrading from an HTTPS with a validated certificate chain to HTTPS without a validated certificate chain. To do that, you would need something like certificate pinning. Once there is a widely deployed mechanism for detecting when a certificate has erroneously changed it would be more feasible to stop treating self-signed certificates as errors.