HSTS for a domain is trust-on-first-use unless the domain is in the browser's preload list.