It it me, or does a hard-coded json file that is manually maintained and compiled-in seem like a terrible idea?

Couldn't Chrome just phone home to a secure server to retrieve HSTS data every once and awhile (just like updates).