Doing it client-side defeats the purpose of certificate pinning. Three years after you rolled out pinning, new users would still be using max ages that were clamped too low.