[discreditable]

HSTS doesn't help if it's your first visit to the site. To work around that they'd need to get into a preload list.

[andygambles]

Which is easy if you set preload header.