So, curious, what happens in the case that my private key is compromised? An attacker can then change my key pinning and prevent users from accessing my website? Heck, can an attacker already do this to many users simply by adding some headers and using their own SSL key? Seems a scary proposition, someone could effectively kidnap control of your domain and you'd have no way to get it back. Especially given the opposition to OCSP by certain parties and the fact that smaller sites have problems even getting on their alternative lists, it could be part of impossible to get your attacker's certificate removed from many of your users browsers.