wondering the same thing. cperciva, care to elaborate? if you had https/hsts would the hashes be unnecessary?