While I have been using HTTPS for a while now and even went through trouble to include my domains for HSTS preloading, one security improvement I never opted to do was inclusion of HTTP Public Key Pinning header (HPKP for friends).
While not impossible to do, on short lived certificates (e.g. Let's Encrypt) it was simply too much trouble to bother. And I wasn't the only one to think so - less than 400 sites (out of top 1 million) decided to bother. Stakes were simply too high that a small mistake on web configuration side might kill your website connectivity.
And so, with Chrome 67, Google is abandoning it.
Replacement for HPKP is offered in the form of the new CT-Expect header. Major benefits are both ease of configuration (just include header) and reliance on the already existing certificate transparency reports to detect issues. While not offering low-level control as HPKP does, it does increase certificate security significantly.
For my site, turning it on was as easy as adding a single directive in Apache httpd.conf:
Header always set Expect-CT "max-age=86400"While this does require some support on the side of certificate authority, it's nothing major. And you should probably run away if your authority has issues with it. When even free Let's Encrypt supports certificate transparency, there is no excuse for others.
Whether this header will stick around for a while or also die in obscurity is hard to tell. However, it's simplicity does make lasting implementation probable.