Apple drops requirement for apps to use HTTPS by 2017

That's irrelevant to the implementation of the Chip. That predates the chip since debit fees are typically lower than credit fees, and this didn't change with the chip being added since dual-option chip cards still give you the choice.

Re: Dear Apple

But isn't that undone by key pinning, since the MITM key would be different from the original's key?

Re: Dear Apple

Sorry, but you can own the CA. That doesn't stop the data being encrypted and out of your reach.

A CA only certifies that a particular certificate is associated with a particular domain, and that someone checked that you own the domain.

A certificate request to a CA *DOES NOT* contain the private key. Nor can it. You sign something with your key, send it to the CA, who signs it with THEIR key, and sends it back. At no point are the keys, or any information that would help discover the key, ever sent.

ONLY YOU have the copy of the private key that can decrypt communications made with your key, and all the CA is doing is adding their stamp of approval to your ownership of the domain in question (or that you paid them enough).

The private key is called that because - IT'S PRIVATE. And it is only ever present on the machines handling requests from outside. The CA doesn't have it, isn't given it, and cannot work it out. You give out your PUBLIC KEY (called that because you can give it away to the general public) in the certificate, but that's what you're trying to do anyway, so people know that ONLY the person with your private key could have decrypted stuff encrypted with your public key - i.e. the data they send you can only be accessed by you).

With certificate pinning and certificate transparency, people notice dodgy MITM certs quite quickly, and browsers can do it automatically (try faking a Google cert, even with MITM SSL, without having to import your MITM cert into your trusted store first).

So, please, stop commenting on that which you do not understand. A secure website is secure no matter who signs your cert. If they replace your cert and try to MITM, they will throw up browser errors if you've configured your site anywhere near properly. It's that simple. Even with the full co-operation of the CA.