To my knowledge, it's both sent over SSL and signed with its own key. SSL pinning just prevents a rogue trusted CA from MITMing you. SSL certificates specify a

To my knowledge, it's both sent over SSL and signed with its own key. SSL pinning just prevents a rogue trusted CA from MITMing you. SSL certificates specify a domain, no matter what the DNS says.