certificate pinning is generally not recommended and wouldn't work in browsers that use the browsers/operating system's root CA store anyways. CAAs can be edited by the one who controls the domain's DNS records.