HPKP

[slashnick]

Add a Public-Key-Pins HTTP header with the leaf public key, and some public keys of offline backup key pairs.

Using out-of-the-box Let's Encrypt with auto-renew will cycle through new public keys every month or two. We can't pin to a moving target, so we need to either automate using the --csr flag to certbot, or use something like acme-tiny (blog post).

[slashnick]

The bot has been fine even after a cert rotation, so we're safe to rotate again with a new public key to get this set up.

I'll document what I do in the wiki, for reference.

[slashnick]

This is done.