Don’t do this with key renew 60d or 90d.
HPKP doesnt support key change from last change to last change + max age. See here.
Having 90d max-age with 60d key renew is a non sense (risk of HPKP break for clients).
Having 90d max-age with 90d key renew put you vulnerable all the time (no way to renew the key before 90d after the last renew, key renew each 90d).
To have HPKP working correctly, you need key renewal >>> max-age (for example max-age 90d with key renew 1y = protected 75% of the time, and 98% with 10y key renew).
The best with HPKP is to have stable key ’til compromission or weakness.
For prod, AIA point to IdentTrust (http://apps.identrust.com/roots/dstrootcax3.p7c), no way to fetch the root LE cert (https://letsencrypt.org/certs/isrgrootx1.pem).
For staging, AIA is wrong (http://cert.stg-int-x1.letsencrypt.org/ is the intermediate, not root).
For custom boulder (at least out-of-the-box, perhaps possible to change this), AIA is IdentTrust too.