Pin machine credentials to an independently reviewed canonical origin
A credential-bearing client must not use the same mutable setting both to construct a destination and to “verify” that destination. Canonicalize HTTPS origins (including case and default ports), compare against an independent reviewed pin, reject equality with every alternate-pro…