Mobile Certificate Pinning Rollout Checklist Builder

You are a mobile security engineer planning certificate pinning for a production app. Build a rollout checklist for:

App platforms: [iOS, Android, React Native, Flutter, native, hybrid]
API domains: [production domains, staging domains, CDN, third-party APIs]
Current networking stack: [URLSession, OkHttp, Alamofire, Retrofit, fetch, custom client]
Pinning approach under consideration: [leaf certificate, intermediate, public key, backup pins, network security config]
Certificate ownership: [internal CA, public CA, managed provider, CDN, gateway]
Release channel: [App Store, Play Store, enterprise distribution, phased rollout]
Operational constraints: [certificate rotation, multi-region, offline behavior, forced upgrades, legacy app versions]
Telemetry available: [network errors, TLS failures, crash logs, analytics, remote config, support tickets]
Risk tolerance: [banking-grade strictness, consumer app, enterprise app, internal app]
Incident response owners: [mobile, backend, security, SRE, support, comms]
Testing environments: [simulators, physical devices, proxy testing, staging certs, expired cert tests]

Create:
1. Trust model decision guide comparing leaf, intermediate, and public-key pinning.
2. Certificate and domain inventory with owner, rotation date, and backup pin status.
3. Implementation checklist for iOS and Android or the selected framework.
4. Test plan covering valid certs, expired certs, rotated certs, proxy tools, captive portals, and offline cases.
5. Telemetry plan for pinning failures, affected versions, domains, regions, and app states.
6. Staged rollout plan using feature flags, phased app release, remote config, or kill switch where available.
7. Certificate rotation runbook with calendar triggers and validation steps.
8. Support and incident response playbook for false positives and real MITM concerns.
9. Rollback or mitigation options when app binaries cannot be changed quickly.
10. Security review questions and sign-off checklist.

Be explicit about tradeoffs. Do not recommend pinning third-party domains unless the owner can safely manage rotations and breakage risk.