alt Hacker NewsCAA records (with ACME account bindings) can prevent this.
HPKP was deprecated because it was too dangerous to be deployed in production.
CAA records (with ACME account bindings) can prevent this.
HPKP was deprecated because it was too dangerous to be deployed in production.
Not when you simply remove the CAA record from the DNS entry