I believe locally-installed certs can override cert pinning (to allow corporate DLP boxes to work, and such).