Ah, cool, that makes more sense (I couldn't think of a reason for that to possibly happen on the first use, since at that point the pinned TLS key wouldn't yet have been invalidated).