Facebook or Instagram will just reimplement it themselves if they care. Smaller developers will just remain insecure. GPLv3 harms adoption of something like this.

If you think that, go implement a MIT-licensed variant.

Not that simple, you have often stated that normal programmers shouldn't be near security and now you are stating that they should go implement something that is specifically to enhance the security of the web.

The gp isn't asking for a change of license because he hate the GPL, he is (properly correctly) predicting what will happen if that license isn't changed: specifically, the thing that Moxie is trying to prevent won't be.

I don't say normal developers shouldn't be near "security"; I say they shouldn't be implementing cryptographic primitives.

Note: AndroidPinning is not a cryptographic primitive.

No, it isn't.

Facebook or Instagram could PAY for getting a license better than GPLv3.

That something is GPL does not mean that could not be also licenced as proprietary for those that pay if they don't want the limitations of GPL.

We live in a world where if the cost of too high for something like this, it will be written off as unnecessary. Unless there is someone really pushing this from within, Facebook/Instagram/etc probably won't implement something like this, or will just create their own (possibly poor) substitute.

I get the idea that people should be paid for their work, and it's his choice how he licenses it. On there other hand, if the point is to make sure this spreads as far as possible and gets used everywhere, then maybe a very permissive license is called for.