A pin trusts one exact certificate, so an expired one or an engine clock that is off no longer locks a device out (X509_V_FLAG_NO_CHECK_TIME).
fluksio.flow.connector_tls: trust the certificate a device presented on first contact, kept in ConnectorNode.store, and name the new fingerprint when another one is refused. Additive, so no contract version bump; hue and wfrac use it.