Certificate pinning
Hardcode which TLS certificate (or CA) a client should accept — extra security beyond the CA system.
Common in mobile apps (banks, crypto). Defends against a compromised CA. Risk: the app stops working when the cert is renewed — pins must be rotated. HPKP for the web was abandoned (too risky). Modern variant: CT (Certificate Transparency).