[Wingy]

If the pinned cert is stored on some kind of ROM chip you could probably rewrite it to replace it with your own cert.