Simple definition
HTTP Public Key Pinning was a deprecated browser mechanism for restricting accepted TLS keys; modern browsers no longer support it.
Purpose and use
Pinning adds an application's expectation about accepted keys or certificates beyond general trust in certificate authorities.
How does it work?
The former Web mechanism HPKP used an HTTP header to remember key fingerprints. Modern browsers removed it; it differs from pinning built into an application.
Example and verification
For an application retaining explicit pinning, prepare and test key rotation and a reliable update mechanism.
Points to watch
An invalid pin can block all affected clients. Deploying the old HPKP header is not a current website-hardening method.
In short
Weigh the intended benefit against lockout risk and the actual certificate and application renewal process.