Right but implementation wise we've never implemented as a default anything else. Domain suffix pinning is available as an extension, but that's all it is - ver

Right but implementation wise we've never implemented as a default anything else. Domain suffix pinning is available as an extension, but that's all it is - very few TLS stacks support it and that's unlikely to ever change.