In addition to the other comments on this subthread, a point I think is worth making:<p>If you&#x27;re providing both an app and a server for the app to talk to you, you control both ends of the TLS connection and  can pin however you&#x27;d like; you&#x27;re not limited to HPKP and key-continuity. Secure apps have been doing custom pins of TLS keys long before HPKP got rolled out.