If you’re talking about services that you’re accessing via a browser, true. If you actually do pinning (properly). For service-to-service stuff and APIs the nu

If you’re talking about services that you’re accessing via a browser, true. If you actually do pinning (properly). For service-to-service stuff and APIs the number of TLS clients that respect pinning is approximately zero. Either way, the other problems remain, and running an internal PKI is really pretty easy.