To implement Cert Pinning on a native mobile app on (e.g. iOS), a new API end-point is being established (e.g. api.example.com). This URL will be setup with a self-signed SSL certificate.
This API end-point URL is meant to be consumed only by this mobile app (and not via Web or other UA). On the mobile app, the "cert not trusted" warnings, if any, can be transparently suppressed to make it seamless for the mobile user.
Is the Cert Pinning validation on mobile app sufficient for the security of data-in-transit (with self-signed cert)?
Do we really require a public SSL certificate in this scenario?
Would a public SSL cert add additional value from a cryptographic standpoint to mitigate MITM (one of the goals of cert pinning)?