[websec] HPKP: Cross-signing with a self-signed certificate and pinning that cert?

[jxtps435 <[e-mail]>]

I'm interested in implementing HPKP on my sites, but it is a bit tricky to
do:

- We add / remove websites from a single SAN certificate on a semi-regular
basis.

- Our CA recently switched out at least their intermediate, if not their
root cert in response to the SHA1 -> SHA256 transition.

- We'd like to be able to switch root CA for business reasons.

So pinning any of these certs seems like a recipe for disaster (maybe
things won't change in the future, but when they have demonstrably changed
in the past I would / should get fired if I don't take that into account).

So basically, I need to be able to switch out our certificates at any time,
for any reason, to any CA, without bricking our sites, to be able to use
HPKP.

Sounds impossible, right?

But wait. What if I could cross-sign my certificates with a self-signed
certificate and pin that certificate?

So the browser would trust the regular root CA's authority, but it would do
the pinning to my not-at-all-trusted self-signed certificate, enabling me
to update my certs whenever I want, and as long as I can keep my
self-signed cert safe no-one else can tamper with our sites.

Would that work in theory? Would that work with current implementations?
Thoughts?


(I don't know the details of cross-signing, but apparently Google does it:
http://googleonlinesecurity.blogspot.com/2015/09/disabling-sslv3-and-rc4.html
)