To my knowledge, it's both sent over SSL and signed with its own key.

SSL pinning just prevents a rogue trusted CA from MITMing you. SSL certificates specify a domain, no matter what the DNS says.