This article suggests pinning ones own cert, and perhaps an intermediate up the chain. It seems that even pinning one root cert would be an improvement, because then that specific CA would have to compromised to MITM. As opposed to the situation now, in which compromising any trusted CA can permit MITM.<p>Do I have that right?