There’s absolutely nothing ordinary or easy about that setup, but I admire it. I’ve only seen that level of paranoia at a three letter agency.
Do applications with pinned certificates break? A bunch of mobile apps do that to get in the way of Wireshark.