On: HSTS for new TLDs

[iancarroll]

but you obviously can't check every domain in the TLD. A preload will still function, that's the whole point: make sure a MITM can't cut off the HSTS header.