Comment by neuralkoi

    In non-CA mode, an attacker who has access to the private key of a pinned certificate can:

       Present a certificate with the correct public key

       Modify the CN in the client certificate to any arbitrary value

       Cause Vault to assign the resulting alias.Name to that CN

I agree that this is an issue, but if an attacker has access to the private key of a pinned certificate, you might have some bigger issues...