What's hard about HSTS?

Look at [1] - in particular, look at the list of Google affiliated domains that don't include "include_subdomains": true, "mode": "force-https"

blogger.com, youtube.com, gmail.com, google.co.uk, doubleclick.net

Google isn't short of competent employees, and they obviously acknowledge the importance of hsts having played a big part in creating it, yet they don't have it turned on. Evidently, getting a single header turned on in a large organisation must be a complicated matter!

[1] https://chromium.googlesource.com/chromium/src/net/+/master/...

only returning visitor will be redirected client side and only if they saw at some point the HSTS header over https.

Took five minutes to configure the preload directive for HSTS in our nginx headers and submit our domain.

The Convergence Project with notaries is an even better solution.

But using the DNS as the authoritative source of data and using external parties to keep an eye on that would both lead to efficiency (performance, flexibility) and security (as in from the State).

DNSSEC is not safe:

1. It requires centralized trust which can be exploited by governments.

2. It still leaves your domain and PKI in the hands of incompetent rent-seeking registrars who can and do get socially engineered all the time.