Resource pinning isn't gonna work unless the app isn't actively being developed. And if it isn't, pinning is redundant.

Public key pinning would disregard the PKI RFCs, so not a good idea either.

If people want to whitelist only some certs they already can by providing the browser only with the specific one's they want to trust.