This is more readable outside of Emacs (which elides link targets).

This is in response to the Digicert emails we have received today, and
to make sure we have somewhere that tells us to talk to TBB people.

HPKP has been removed from Chromium in 2017:

https://www.zdnet.com/article/google-chrome-is-backing-away-from-public-key-pinning-and-heres-why/

It's better to have numbered steps than lots of headings.

TLS covers more than just letsencrypt: there we could document our
custom CAs and the other signing mechanisms also in operation in Tor
that we might get into contact with.

This is specifically in preperation for the documentation of the
contacts we had with digicert.

the TTL should be lowered before the reboot. we should also use the
"standard" reboot procedure as per fabric so that we wait for the halt
to proceed.

the TTL procedure also now documents how the DNS changes can get
forcibly propagated.

finally, we merge the shutdown and migration stage as it seems like a
natural progression while keeping the number of steps constant from
before the TTL introduction.