Via certificate invalidation, or turning off services for certificate pinning?