Add a preloaded (wrong) HPKP pin for pinning-test.badssl.com

net/http/transport_security_state_static.json

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file contains the HSTS preloaded list in a machine readable format.
 
 // The top-level element is a dictionary with two keys: "pinsets" maps details
 // of certificate pinning to a name and "entries" contains the HSTS details for
 // each host.
 //
@@ skipping 162 matching lines @@
       "static_spki_hashes": [
         "GeoTrustGlobal",
         "DigiCertEVRoot",
         "SpiderOak2",
         "SpiderOak3"
       ]
     }
   ],
 
   "entries": [
-    // Dummy entry to test certificate pinning.
+    // Dummy entries to test certificate pinning.
     { "name": "pinningtest.appspot.com", "include_subdomains": true, "pins": "test" },
+    { "name": "pinning-test.badssl.com", "include_subdomains": true, "pins": "test" },
 
     // (*.)google.com, iff using SSL, must use an acceptable certificate.
     { "name": "google.com", "include_subdomains": true, "pins": "google" },
 
     // Now we force HTTPS for subtrees of google.com.
     { "name": "wallet.google.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
     { "name": "checkout.google.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
     { "name": "chrome.google.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
     { "name": "docs.google.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
     { "name": "domains.google.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
@@ skipping 3925 matching lines @@
     "CHROME_COM",
     "GVT3_COM",
     "GVT2_COM",
     "GOOGLE",
     "GGPHT_COM",
     "BLOGSPOT_COM",
     "DROPBOXSTATIC_COM",
     "DROPBOXUSERCONTENT_COM",
     "WITHYOUTUBE_COM",
     "WITHGOOGLE_COM",
-    "G4W_CO"
+    "G4W_CO",
+    "BADSSL_COM"
   ]
 }