Possibly stupid question here (this is not my domain), but what is the alternative to pinning the client to use your leaf certs? If it's pinning to your root cert, then isn't that much more of a pain if/when you need to revoke what the client is using? Or is the correct alternative to pin "to one or multiple rsa public keys" as mentioned in the sibling comment?