However this amendment is disgusting.
I was one of the many experts reviewing previous drafts; the timing and content of these changes are absolutely an attempt by security services to break security on the web.
The "we" reading this post? Yeah, probably.
The internet population as a whole? Absolutely not, nowhere close.
I've been using Adblock or its descendants since the original Firefox extension where downloadable filter lists were a separate addon, and every time I have to browse a mainstream web site when using a "normal" person's computer it blows my mind how bad the experience is with all kinds of extra iframes I never normally see full of ads moving around, modals, etc. without even getting in to video content.
Normal people don't troubleshoot things like we do, if it doesn't work they try to do the same thing over and over again until they get bored or annoyed and then either move on or call one of us to "fix it".
My comment was about the perspective of the website owner, not the website user. The website owner certainly doesn't want to be routed around and have the website die. So the website owner will avoid HPKP.
Case in point: the DNS client never actually validates the DNSSEC signatures, the DNS server the client uses is supposed to do that, and then simply sets a flag that says "I validated this". Perfect for recursive DNS resolvers running on localhost, but terrible for security when applied as designed.
Another example: Firefox currently has encrypted client hello enables to encrypt the SNI information and help combat traffic analysis, but only if you enable DoH to ensure that the necessary DNS records are correct. Once again, Mozilla didn't trust DNSSEC to work right and opted to trust DoH servers on their word.
In truth, DNSSEC isn't widely used, at least not internationally. Some TLDs have high DNSSEC usages, often because their registrar advocates for securing DNS, but with companies like Amazon failing to produce DNSSEC software that doesn't cause massive outages and TLDs like .nz going down for a day because of bad policies and management, many people don't bother.
It's a shame, really, because DANE would've fixed so many problems. I attribute its failure mostly to the design decisions the people behind DNSSEC made when they released the protocol.
It would basically make services like Let's Encrypt unnecessary and would move us close to a world where email encryption and validation works by default.
DNSSEC sucks ass.