I think that instead of HPKP, the parent poster meant to refer to HSTS.<p>If the attacker MITMs an HTTPS request, then they have to provide a forged certificate (whether HSTS is set or not).<p>If the attacker MITMs an HTTP request which would have normally been redirected (e.g. typing &quot;facebook.com&quot; into the URL bar), then HSTS is required. Without it, no forged certificate required.<p>HTTPS and HSTS should have just been the baseline the web shipped with, but the web shipped before people thought about these things, and arguably before encryption was stable&#x2F;secure&#x2F;fast enough to be practical for the whole web.<p>I&#x27;m very happy that the federal HTTPS-policy includes an HSTS requirement for federal agencies: <a href="https:&#x2F;&#x2F;https.cio.gov&#x2F;" rel="nofollow">https:&#x2F;&#x2F;https.cio.gov&#x2F;</a>