Interesting stuff. Did HSTS seem out of place to anyone else? Not that it's not important, but compared to the rest of them, it hardly seems like it "changed everything." And from the gut, I'd guess that CORS has done more than HSTS to reduce harm on the internet.