[derekp7]

Or, a local ISP or the coffee shop you are visiting has an appliance that injects ads into http web sites. And those ads come from an ad network, that doesn't do a good job of policing malware that gets into the ad's javascript. (Malware-laced ad networks is actually the #1 reason I use an ad blocker, since that is the only times I've ever got computer viruses).

[dvfjsdhgfv]

What ISPs are doing in the USA is beyond me - how on Earth people can tolerate inserting or messing with the traffic in similar ways?

As for coffee shops and other public access points, people really need to understand the consequences of what are doing when connecting to any of these. Using HSTS is just an antidote to one particular problem. But when you connect to a hostile AP, many worse things can happen.