Targets don't have to cry foul. Broken pins can be reported automatically. People on the Chrome and Mozilla security teams can monitor them. It's not like this is an abstract point: it's already happened!

I'm not sure what you're trying to say about "state actors" and HPKP. No matter what happens: the NSA will control the DNS. We all stipulate that they control CAs. DNSSEC does nothing to change this (it actually ratifies it), but HPKP does.