HPKP will accept if any of the fingerprints match -- I was wondering how I could transition certificates when using it, and hadn't noticed that fact. So to transition to a new certificate, specify the fingerprint of the old AND new certificates, for at least as long as the max-age. You can also specify the fingerprint of any certificate in the trust chain. I plan on pinning the let's encrypt certificate, instead of the specific certificates let's encrypt issues, and trusting let's encrypt to implement the domain validation correctly.