HTTP Public Key Pinning (HPKP) is a standard that allows a HTTPS website to specify which certificates it trusts, and instruct the browser not to allow any connection to that site that's secured by any other certificate.
Can this be used to facilitate a persistent denial-of-service attack on a website? Suppose an attacker compromises a website like cnn.com (say). It seems like the adversary could configure the webserver to enable HSTS and HPKP, with a pinning policy that specifies a certificate controlled by the attacker. The attack might be discovered and the legitimate administrators regain control, but everyone who visits cnn.com in the meantime will receive a HSTS and HPKP policy and their browser will cache it. As a result, their browser won't allow any HTTP connection to cnn.com (due to the HSTS policy) and will only allow HTTPS connections if the server uses the pinned certificate and public key. But since the attacker specified the pinned cert, it might be using a private key controlled by the attacker and not known to cnn.com. Consequently, after the attacker is kicked off, cnn.com has no way to terminate a SSL session using that attacker-chosen private key. So, all future connections from those browsers to cnn.com will fail.
The HPKP standard does suggest that browsers should set a maximum age for these policies, but it also suggests setting the maximum age to 60 days. So, if I'm understanding this correctly, it means that if an attacker temporarily compromises a website, then the attacker can ensure that the website will be absolutely unreachable for the next 60 days for all users who visit the website during the brief time when the website is compromised. Basically, any user who visits the website at a time when it is controlled by the attacker is "poisoned" for the next 60 days, and the website appears simply unreachable.
As website breaches are not unheard-of, this seems like it would be a rather severe outcome. This is a rather unusual sort of denial-of-service attack: it allows for irreversible vandalism of a site that there's nothing the website admins can do anything about, except to wait. the It also looks like this attack could be exploited against any website, even one that's not currently using HPKP, HSTS, or even HTTPS.
Have I understood this correctly? Are there any mitigations that a website can take to prevent itself from being DoS'ed in this way? Is there an argument that HPKP doesn't introduce any new DoS risk that's any more severe than what already existed before HPKP? Has this kind of persistent DoS attack ever been observed in the wild?
I've read RFC 7469, the standard that describes HPKP, and it doesn't seem to have any mitigation. It appears the attack I described would qualify as an instance of 'hostile pinning', but the standard doesn't seem to mention any useful mitigation for hostile pinning (apart from the max-age).