Comment by w3ll_w3ll_w3ll

CAA records (with ACME account bindings) can prevent this.

HPKP was deprecated because it was too dangerous to be deployed in production.