You'd need to issue a fake certificate to do a MITM attack, they wouldn't be able to decrypt existing traffic without issuing one, which would be noticed by som

You'd need to issue a fake certificate to do a MITM attack, they wouldn't be able to decrypt existing traffic without issuing one, which would be noticed by someone watching. Key pinning would have helped with that but it was mostly used to accidentally lose your keys and lock people out of your server.