Pin the major identity provider certificates or public keys

[ssoroka]

or rather, their CA's cert, which is less vulnerable to rotation issues, and a happy compromise.

[github-actions]

This issue has not seen any activity in a while. Add a comment if this issue is still relevant,
otherwise it will be closed in 7 days.