Can someone explain how Certificate Pinning works in a "trust no one" scenario? From my understanding, the idea is that you grab the certificate for a given dom

Can someone explain how Certificate Pinning works in a "trust no one" scenario? From my understanding, the idea is that you grab the certificate for a given domain once with the correct public key and then store it for later so that you can be notified when you're being MitM'd. But that assumes that the one you got was trustworthy to begin with: what happens if you're already a target or in a surveillance state and, having not previously visited the domain before, cannot guarantee that the pinned certificate you're getting is trustworthy?