It'd be nice if HSTS also allowed you to limit the root CAs that should be signing your site's certificate.