Nice writeup, and a nice demonstration of one of WebPKI's limitations!
I understand why both HPKP and Expect-CT have been obsoleted, but it's a bummer that we still don't have a good enforcement mechanism for CA/cert pinning for a particular site. CT itself does a reasonable job of mitigating the "globally visible mis-issuring CA" problem, but does nothing to help users whose certificate stores contain all kinds of mystery enterprise or application-installed CAs.
I understand why both HPKP and Expect-CT have been obsoleted, but it's a bummer that we still don't have a good enforcement mechanism for CA/cert pinning for a particular site. CT itself does a reasonable job of mitigating the "globally visible mis-issuring CA" problem, but does nothing to help users whose certificate stores contain all kinds of mystery enterprise or application-installed CAs.