github.com/GrapheneOS/Att
It's too bad there aren't timelines for having secure defaults for the other important security features controlled by headers.
Not dropping Expect-CT quite yet since it still has value with out-of-sync clocks and clients with different CT requirements.