I agree that the semantics of "adequate" and "very" are moot. As always, it ultimately depends on your threat profile, real or imagined. Re: certificate pinni

I agree that the semantics of "adequate" and "very" are moot. As always, it ultimately depends on your threat profile, real or imagined. Re: certificate pinning, it's common practice in the financial industry at least. It mitigates a few risks, of which I'd rate DNS compromise as more likely than a rogue CA or a persistent BGP hijack.