HPKP was used to ensure that a browser accepts to connect to a site only if the public key he has on file is the one presented by the target site. I saw it as a way to make deep content inspection more complicated (some sites would simply not accept the connection so there is nothing to inspect).
It seems however (from the Wikipedia page) that
Most browsers disable pinning for certificate chains with private root certificates to enable various corporate content inspection scanners and web debugging tools (such as mitmproxy or Fiddler). The RFC 7469 standard recommends disabling pinning violation reports for "user-defined" root certificates, where it is "acceptable" for the browser to disable pin validation.
So no protection anymore against deep inspection (I am not sure what the mechanism is for in that case but anyway).
This probably does not matter anymore taken that
The mechanism was deprecated by the Google Chrome team in late 2017 because of its complexity and dangerous side-effects. Google recommends using the Expect-CT as a safer alternative
Certificate Transparency is a public log of issued certificates
- How does this log help to ensure that the certificate I see is the one actually presented by the target site, and not an intermediate one (where my session is terminated on the deep inspection engine, which replays the connection)
- If it indeed helps to do that, how does the "enterprise" restriction highlighted for HPKP above comes into play (if at all)?