I like the idea of a client-specified HSTS header - allowing users to control their risk directly (albeit through a browser extension) would definitely be a good thing.