The current certificate pinning (and the upcoming pubkey pinning, too) works more or less like the traditional SSH client, prompting for trust on the first connection (with a list of errors encountered so far, if any) and complaining very loudly whenever the public key changes. This is good, but it would be even better if the code also checked other properties of the peer, like whether the certificate was blacklisted, expired, revoked, not meant for this use etc etc.

It remains to be designed how to present this to the user, what choices to offer (e.g. whether to allow for individual checkboxes for ignoring certain errors like unrecognized CA or a self-signed certificate) etc.