I meant https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security

But actually it should be using a CAA DNS record to set which CA is allowed to sign certificates for the domain.