public static function getHPKPHeader(array $config): array
    {
        $headers = [];

        foreach ($config['hashes'] as $hash) {
            $headers[] = sprintf('pin-sha256="%s"', $hash);
        }

        $headers[] = sprintf('max-age=%d', $config['max-age']);

        if ($config['include-sub-domains']) {
            $headers[] = 'includeSubDomains';
        }

        if (! empty($config['report-uri'])) {
            $headers[] = sprintf('report-uri="%s"', $config['report-uri']);
        }

        $key = $config['report-only']
            ? 'Public-Key-Pins-Report-Only'
            : 'Public-Key-Pins';

        return [$key => implode('; ', $headers)];
    }