`pinning` should pin public keys, not certificates about ocaml-x509

[cfcs]

How does this change influence revocations, pinning expiry date, etc?

[hannesm]

revocations are still not checked... the server which revokes its certificate better generates a new private key...

pinning expiry date -- I don't understand what you mean by that? if you use pinning, and the certificate gets renewed (still using the same certificate signing request / public key), the pin will be valid later as well. (which changes the behaviour considering the old certificate pinning implementation)

[cfcs]

Yes, but you would be revoking the certificate, not the key.
So the attacker can just make a new certificate containing the same key, and keep using that?

This also has problems with existing software which hashes certs the "old school" way.
That functionality should at least be retained.

Yes, re: expiry date.
Is that desirable?
Then I, as a server operator, would have no way to put a time limit on a key intended for fingerprinting (since an attacker can just keep making new certificates containing the old key).