URLSessionDelegate vs TrustKit for SSL Pinning

Implementing SSL pinning in a Swift application requires a choice between utilizing the native URLSessionDelegate for manual trust evaluation or integrating a third-party library like TrustKit.

Using the native urlSession(_:didReceive:completionHandler:) method allows for direct control via SecTrustRef and eliminates external dependencies, reducing binary size. However, this approach requires manual handling of the certificate chain and increases the risk of security vulnerabilities if the evaluation logic is flawed.

Conversely, TrustKit abstracts the Security framework's complexity and provides built-in support for backup pins, which simplifies certificate rotation without necessitating immediate app store updates. This introduces a dependency and a slight increase in the application's footprint.

• Which approach is more sustainable for projects requiring frequent certificate rotations?
• What are the security implications of manual SecTrustEvaluateWithError implementation compared to a vetted abstraction?