HSTS Fingerprinting.

A year or two ago, +John Wilander <wilander@apple.com> and others at Apple
proposed some changes to HSTS in
https://webkit.org/blog/8146/protecting-against-hsts-abuse/ that went some
way towards mitigating the abuses documented in Section 14.9 of RFC6797
<https://tools.ietf.org/html/rfc6797#section-14.9>. Given some shifts in
the way we're thinking about some other concepts, I've written up a short
proposal at https://github.com/mikewest/strict-navigation-security that
builds upon and simplifies Apple's proposal. We discussed it briefly at
yesterday's webappsec meeting
<https://github.com/w3c/webappsec/blob/master/meetings/2019/2019-09-TPAC-minutes.md#hsts-fingerprinting>,
and there seems to be interest in doing something in this space.

+Mark Nottingham <mnot@mnot.net> and +Jeff Hodges
<jdhodges@google.com> suggested
that I loop this group into that conversation, as the original websec group
has disbanded. Is it a topic this group would like to pick up? If not,
would y'all be comfortable with us defining some web browser behavior/Fetch
integration in webappsec that constrains the existing RFC?

Thanks!

-mike