&gt; <i>When your site sends such a header, Chrome will verify if the current connection matches the pins, and sends a report to the report-uri if not.</i><p>Huh.  I wonder if this can be used for exploits?