[nickf]

CAs are gonna start rotating more frequently soon, and you may even see randomisation. Pinning to public certs is a real no-no.