I've seen code that pins entire cert chains, up to and including a specific root CA. Sometimes not even the public key but memcmp with the root's entire public

I've seen code that pins entire cert chains, up to and including a specific root CA. Sometimes not even the public key but memcmp with the root's entire public certificate