I'm quite surprised that "Lack of SSL Pinning" is considered a vulnerability. I have to admit that I don't have cert pinning enabled on mt domains, mostly becau

I'm quite surprised that "Lack of SSL Pinning" is considered a vulnerability. I have to admit that I don't have cert pinning enabled on mt domains, mostly because I haven't taken the time to fully understand the implications of what enabling it means. I've heard that you need backup certs that are listed as being authorized for disaster recovery, but I'm not totally sure what that entails. Do most see not implementing this as a critical security vulnerability?