How else could they let the end user know what's going on? Due to pinning, it's either present a phony certificate, or completely fail the connection and give t

How else could they let the end user know what's going on? Due to pinning, it's either present a phony certificate, or completely fail the connection and give the user no indicationo why. Of course, accepting the phony certificate will immediately leak your cookies to the middlebox, along with giving it permission to read any credentials out of local storage. So as an end user you should not accept it.