private function hpkp(): array
    {
        // TODO : lever une exception si les champs hashes et max-age sont vide, car ils doivent tous les deux avoir une valeur chacun (cad un hash au minimum + un maxage)
        $values = [];
        foreach ($this->security['hpkp']['hashes'] as $hash) {
            $values[] = sprintf('pin-sha256="%s"', $hash);
        }
        $values[] = sprintf('max-age=%d', $this->security['hpkp']['max-age']);
        if ($this->security['hpkp']['include-sub-domains']) {
            $values[] = 'includeSubDomains';
        }
        if (! empty($this->security['hpkp']['report-uri'])) {
            $values[] = sprintf('report-uri="%s"', $this->security['hpkp']['report-uri']);
        }
        $header = $this->security['hpkp']['report-only']
            ? 'Public-Key-Pins-Report-Only'
            : 'Public-Key-Pins';

        return [$header => implode('; ', $values)];
    }