CA pinning for DNF (sslcacert honoured?)