I think we could probably set this up with the mock cert verifier:  Send a request (Or do a navigation) that sets a valid HPKP header (setting the mock verifier to give a matching result).  Then modify the verifier to return another result, and do the navigation that should fail.

Actually, think I'll just see if I can manage that now.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/08be4f5b9dcae8cd37e0926d3ce0054fdafd83df

commit 08be4f5b9dcae8cd37e0926d3ce0054fdafd83df
Author: Matt Menke <mmenke@chromium.org>
Date: Tue May 29 21:29:41 2018

Make PKPModelClientTests pass when the network service is enabled.

They used to directly add an entry to TransportSecurityState, but now
they set up a second test server, and use a response from that to pin
a cert.

Bug:  844034 
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_mojo
Change-Id: Ie9efefadc23d1518a0be25e7d8238489275feb3e
Reviewed-on: https://chromium-review.googlesource.com/1073195
Commit-Queue: Matt Menke <mmenke@chromium.org>
Reviewed-by: Emily Stark <estark@chromium.org>
Cr-Commit-Position: refs/heads/master@{#562596}
[modify] https://crrev.com/08be4f5b9dcae8cd37e0926d3ce0054fdafd83df/chrome/browser/ssl/security_state_tab_helper_browsertest.cc
[modify] https://crrev.com/08be4f5b9dcae8cd37e0926d3ce0054fdafd83df/testing/buildbot/filters/mojo.fyi.network_browser_tests.filter