[allset_]

HSTS prevents the first of these if the client has connected to the server previously.

Chrome also hasn't trusted certs with MD5 since version 65.

[snug]

HSTS Preload prevents that from happening even if they never visited the site