Implement HPKP, defaulting to off with a 15 second max-age