Suppose my Public-Key-Pins max-age is 60 days. When can I deploy a new cert? 60 days from now? But what about browsers who first connect to my site between now and 60 days from now?
This site says:
When GitHub [who uses HPKP] wants to replace its TLS certificate, the new certificate must be signed by either DigiCert or Symantec – otherwise, none of the key hashes in the new certificate chain would match the existing HPKP policy, and its users would be blocked from accessing the site.
So, I can't deploy a new cert signed by a different CA (e.g., Let's Encrypt's) than that of the one I originally pinned (e.g., Verisign)?
Is this why it's recommended to pin a backup cert from a different CA?
cf. p. 315 of Ivan Ristić's Bulletproof SSL and TLS (2014)