Pin the major identity provider certificates or public keys #920

or rather, their CA's cert, which is less vulnerable to rotation issues, and a happy compromise.