If the above reports of not Apple not pinning their certificate, then this isn't secure enough against any adversary that can compel or hack a CA to issue you a

If the above reports of not Apple not pinning their certificate, then this isn't secure enough against any adversary that can compel or hack a CA to issue you a certificate in Apple's name. The latter appears to be not as hard as you might imagine. And the recent fail in their SSL/TLS library means you don't even need the help of a CA to create a certificate Apple software would consider valid.