HPKP has been removed from Chromium in 2017:

https://www.zdnet.com/article/google-chrome-is-backing-away-from-public-key-pinning-and-heres-why/

It's better to have numbered steps than lots of headings.

TLS covers more than just letsencrypt: there we could document our
custom CAs and the other signing mechanisms also in operation in Tor
that we might get into contact with.

This is specifically in preperation for the documentation of the
contacts we had with digicert.

That scenario is more complex and has more implications than just
renewing the key. It *also* includes cert revocation so it's implicit
as well.

thanks weasel for the instructions

split each step more clearly

This reverts commit 5b8ed68c.

still haven't quite figured out how keys actually get to the puppet
server yet.