> without some form of certificate pinning, could still be MITM'd Now, apparently this uses plain http - but if tls/https is an option - any client (like curl/

> without some form of certificate pinning, could still be MITM'd Now, apparently this uses plain http - but if tls/https is an option - any client (like curl/wget) should by definition come with a ssl trust root (os or bundled). If this is mitm'ed, you've got big problems. Certificate pinning doesn't really help that much in this case.