From RFC7469:<p>&quot;user agents (UAs) will require that the host presents a certificate chain including at least one Subject Public Key Info structure whose fingerprint matches one of the pinned fingerprints for that host.&quot;<p>This makes it easier to deploy. If an org repeatedly gets their certs from a single CA they can just pin that CA. It does of course open you up to being compromised if anyone compromises that CA. But, like you said it&#x27;s a big improvement over nothing.