So modify the application binary to swap out the certificate in order to spy on the traffic. Difficult, but not impossible.