More info here if anyone's interested in HPKP: https://scotthelme.co.uk/hpkp-http-public-key-pinning/
I think it could make sense to pin an offline key which is in turn used to sign online keys -- it's at least somewhat feasible to build secure, reliable storage for offline keys. But with current tech that would require that your offline key is a CA key, and as a regular user you have no ability to obtain such a certificate.
So basically I don't think HPKP is a good idea, unless you are Google.
I think certificate transparency is the most promising way forward here.
Unfortunately HPKP was adopted by the browsers and TACK has gotten no traction with the vendors, despite being a more flexible system.
On balance, yours is a solid decision for your company and for typical users. Just pointing out a complication with something new people are starting to use.
I've just started using it with a short TTL and several extra hashes I can fall back on in reserve. Works fine but I'm definitely not 'all in' yet.
Edit: Also, if my understanding is correct you _do_ create an offline 'key' to generate hashes with a backup CSR, though this won't help if your machine (with the backup CSR used to generate a new key & recover from a server compromise) is also compromised.
You're also allowed to pin any certificate in the chain, not just the end-entity cert (https://tools.ietf.org/html/rfc7469#section-2.6), so you have some other options. You can pin some number of CAs that you think are trustworthy CAs: pin not only GlobalSign but a few other major CAs that you'd consider using in the future. That doesn't protect you from all the things HPKP could possibly protect you from, but it does protect you from the DigiNotars and MCS Holdings and TURKTRUSTs of the world.