[moxie]

In that case, I would generally recommend that you create your own trust root and validate against it, rather than using pinning?

[tptacek]

That makes sense if yours is the only client that connects to your endpoint, but less sense if your client shares an endpoint with, say, a web app.

I try and I try to get clients to consider just rolling their own root certificate and eschewing the TLS PKI, but people have an irrational fear of the process of making certificates.