@florian No, the cert or the CA is not pinned, since you can switch to a different DoH resolver and it works. I assume they just use the same algorithm as for other HTTPS sites (after all, one of the points of #DoH was to reuse the existing HTTPS stuff).