In a scenario where client -> server through SSL, the server replies with the set of cert(chain-of-trust) which also contains the certificate pinned inside the client.
Let's say the Root CA is compromised and the setup is this : client -> MiTM -> server
Can't the MiTM just use the set of certs from the server to bypass certificate pinning? Does the pinned cert have to be the leaf-certificate in the chain?