We're building a suite of mobile apps where the communications to/from the server's REST API need to be as secure as possible.
The intention is to use TLS (i.e. https) at the session layer.
However, I've become aware that, on a jailbroken/rooted device it's possible to sniff SSL traffic by inserting a trusted certificate onto the device itself.
Therefore, one idea was to add encryption at the application layer too. In the words, exchange keys with the server (server sends its public key to client, client sends its public key to server) then use these as an additional layer of security.
Would this confer any additional security benefit or is it a pointless duplication of effort?