For ~40 minutes, it was also impossible to SSH into any Compute Engine instance that uses OS Login for authentication, but it seems to have been resolved in the last few minutes.
Ubuntu 18.04, the newest LTS, recently backported OpenSSL 1.1.1 to its stable package repository.
Because of this my personal webserver, running nginx on Ubuntu 18.04, started offering TLS 1.3 without any manual action on my part, because the server is configured to auto-apply updates from these repositories.
No, it doesn't. As mentioned in the article, the attacker successfully requested a TLS certificate for the hostname, which was possible because he could pass a CA's domain validation.
I'm not entirely sure, but I think HPKP could have prevented this for returning customers, because Fox-IT would have been able to pin the key of their own certificate. Then the new certificate used by the attacker would have been rejected by the customer's browser.