... and even pinning won't save you unless you use a tool to monitor your connections and confirm you actually are using the cert your browser is saying you're using.

I'm not entirely sure it's possible to build such a tool.