[sandij]

When pinning CAs instead of certificates, you’d use CAA instead of HPKP.

[toast0]

CAA isn't restricting acceptance of certs, it's restricting issuance, assuming the attempted issuer is compliant, competent, and that your domain didn't get hijacked.

[BillinghamJ]

That wouldn’t work, as there’s no differentiator between EV and non-EV