3 ms·
There's nothing stopping you from pinning exclusively to keys under your control. A pin counts as satisfied if the hash matches at least one of the keys in the
by pfg 10y ago
There's nothing stopping you from pinning exclusively to keys under your control. A pin counts as satisfied if the hash matches at least one of the keys in the certificate chain, including the end-entity certificate itself. In other words, if you do not trust any CA, HPKP can still help you.
For most sites, pinning to a small set of CAs is sufficient and a vast improvement, but if you chose to trust no one, that's fine too.