What I still don't understand about certificate pinning is - why am I still able to access Google apps through a corporate MITM? I know that I have the root cert for my corporation installed on my PC, but shouldn't Google throw an error when its sites are signed by a cert (my corporation's cert) that does not match one of the pinned certs on Google's servers? Maybe I'm misunderstanding how pinning works.
With browsers that have certificate pinning, user-installed root CAs are normally exempted from pinning requirements; if the certificate received doesn't match the pinned certificate or key but is signed by a custom-added CA, the browser doesn't complain. This is done to support the exact scenario here, as well as the scenario where a user decides to MitM themselves (to, for instance, inspect all of their own network traffic). Source (the blogger in question, Adam Langley, works on the Chrome network stack and Google's HTTPS infrastructure).