When the user grants permission to a site, how does that permission work? By domain or resolved IP address? If it&#x27;s by domain and there&#x27;s no HPKP for it (and IP not cached), the MITM can send a malicious IP through DNS for any domain. The server at malicious IP can fake being whatever domain and the attack will work.