It suffices to just forward-declare DnsCertProvenanceChecker

chrome/browser/io_thread.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/io_thread.h"
 
 #include <vector>
 
 #include "base/command_line.h"
 #include "base/debug/leak_tracker.h"
@@ skipping 30 matching lines @@
 #include "net/base/mapped_host_resolver.h"
 #include "net/base/net_util.h"
 #include "net/ftp/ftp_network_layer.h"
 #include "net/http/http_auth_filter.h"
 #include "net/http/http_auth_handler_factory.h"
 #include "net/http/http_network_layer.h"
 #include "net/http/http_network_session.h"
 #include "net/proxy/proxy_config_service.h"
 #include "net/proxy/proxy_script_fetcher_impl.h"
 #include "net/proxy/proxy_service.h"
+#include "net/socket/dns_cert_provenance_checker.h"
 #include "webkit/glue/webkit_glue.h"
 
 #if defined(USE_NSS)
 #include "net/ocsp/nss_ocsp.h"
 #endif  // defined(USE_NSS)
 
 namespace {
 
 // Custom URLRequestContext used by requests which aren't associated with a
 // particular profile. We need to use a subclass of URLRequestContext in order
@@ skipping 628 matching lines @@
   system_params.network_delegate = globals_->system_network_delegate.get();
   system_params.net_log = net_log_;
   globals_->system_http_transaction_factory.reset(
       new net::HttpNetworkLayer(
           new net::HttpNetworkSession(system_params)));
   globals_->system_ftp_transaction_factory.reset(
       new net::FtpNetworkLayer(globals_->host_resolver.get()));
   globals_->system_request_context =
       ConstructSystemRequestContext(globals_, net_log_);
 }