Resulting in a nice, unskippable HSTS error for your victim when they go to pretty much any site that matters.

Again: this is the exact scenario HSTS protects from. It's already widely deployed and there are even some entire TLDs that are preloaded.