You can pin, but almost nobody does (and half the world that does pin is probably pinned to Let's Encrypt).

Those who manage the root domains should have been able to pin who they trust, and then if you WANTED to you could add someone beyond what .com or .egg or .muffin lists.

▲

ipdashc 5 hours ago | parent [-]

> and half the world that does pin is probably pinned to Let's Encrypt

To be fair, unless I'm misunderstanding, wouldn't this be a good move?

LE has a good security record and takes itself seriously, versus these smaller CAs that seem to mess up regularly.

▲

bombcar 3 hours ago | parent [-]

All your eggs end up in one basket usually because it's a really good basket.

All things turn and curve and degrade; Google used to be the "it's perfect" darling.

	▲	sureglymop 42 minutes ago \| parent [-]
		Interesting to mention Google because the whole system still relies on them. They decide what certificate transparency logs can enter the program and offer the list of logs. If you don't trust Google web PKI falls apart.