KMP TLS / SPKI pinning for a shared Ktor client

Pin the server's public key (SPKI SHA-256) for a Ktor client shared in commonMain. Grounded in Ktor 3.5.x (ktor-client-okhttp, ktor-client-darwin), OkHttp's CertificatePinner, and Apple's Security framework.

• The client is shared, the trust mechanism is not. A KMP Ktor client uses a different engine per target — OkHttp on Android, Darwin (NSURLSession) on iOS — so pinning is applied per engine. Same pin set, two mechanisms, joined with expect/actual (see expect-actual).
• Builds on kmp-networking (the shared HttpClient factory). iOS SecTrust/SPKI details live in swift-security; the Android declarative alternative in mobile-security.

Contents