Yeah that sounds weird. Certificate pinning and HSTS should protect from that, right?