I suppose it's possible to inject STS headers into responses using onHeadersReceived, though I would be a bit nervous about doing that. Without an API to remove an STS directive, if any rule has an error (or if a site stops working with https), it would be broken forever (or at least until the caches are cleared)