muhpirat

You can try to scrap them out of DNS servers

I think the domain indicades something like keybase.

If they have a bug bounty programm, look at it.

Also try to contact the $company's domain Admin (who.is e.x. give it to you) or, if availabel, the Network Abuse Team for further help to get in contact.

I use LetsEncrypt and ggssl.com. Simple. Free/Cheap. Nice customer support.

So... I think because of this, I will buy a VR-Glass :3 <3

Ahh nice, thank you :-)

Ohh to add this: I know HPKP works with Publickeys, the only question is, if I need to sign it first or can I sign it when I need it?