I take the middle way: Add root Comodo and one other CA as valid fingerprints. Now an attacker would not only need to execute the MITM attack (which is actuall

I take the middle way: Add root Comodo and one other CA as valid fingerprints. Now an attacker would not only need to execute the MITM attack (which is actually pretty easy and pretty common, which I think you're downplaying, but whatever) but they also need to have hacked one of two CA providers that reside in the USA. If my threat vector is passive collection by state actors or state supported actors like some cyber criminals, then I've mitigated most of if. Only the USA could still easily get my site. But I have to trust them anyway because they create my computer (including CPU, network adapter, and OS), Github account, email, router, and phone. Short of using a 0day or something similar against my server, which I admit is possible, the attacker cannot easily bulk collect / fabricate / tamper requests to and from my server. I agree it isn't perfect, but it's good enough.