* Why would HSTS help in this case? While HSTS is active, does it prevent clicking through the warning (which was done here)?
* How would a CAA record help against cert issuance in this case? Is it only helping against compromise of the authoritative during the remaining TTL of the record in recursives AND if the CAA record points to something that doesn't have on-demand DV like Lets Encrypt?
* Why would HSTS help in this case? While HSTS is active, does it prevent clicking through the warning (which was done here)?
* How would a CAA record help against cert issuance in this case? Is it only helping against compromise of the authoritative during the remaining TTL of the record in recursives AND if the CAA record points to something that doesn't have on-demand DV like Lets Encrypt?