Years ago I read a blog that taught the series of steps needed to perform GNUTLS certificate pinning for Emacs use. At the time, it seemed like a convenient way to boost security. After all, services were only renewing their certificates every 2–3 years, so once you set up your configuration, you wouldn't have to change it for a long time.

But then Lets Encrypt came along and was widely adopted. LE thinks that it is best that certificates expire after only a few weeks. So, if you have pinned a lot of certificates, you start to feel that it is too much work to manage that configuration, you constantly have to update it.