Hacker News Reader

It doesn't work if the user hasn't visited the site before because the HSTS header can be stripped just as easily.

The HSTS specification tells you not to put those headers in regular HTTP requests anyway.

Also, you're forgetting about browsers that ship with lists of HSTS-enabled sites.