Pinning can narrow server trust, while attestation provides client-context evidence. They address different ends of a connection.
Evaluation approach
Assess networking and client verification against separate threats. Keep back-end authorization.
Application example
A modified client can connect to the right server; an attested app can still contain faulty TLS validation.
Limits and considerations
Having one feature does not automatically make the other unnecessary.
Do both successes close the same risk?
Correct server identity and valid application context are distinct assurances. Even together, they do not authorize every user action.
Checks and decisions
- Separate trust questions
- Test both failures
- Retain authorization
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.