Implement --pinnedpubkey option which will take a path to a public key in DER format and only connect if it matches (currently only implemented with OpenSSL).
Extract a public RSA key from a website like so:
openssl s_client -connect google.com:443 2>&1 < /dev/null | sed -n '/-----BEGIN/,/-----END/p' | openssl x509 -noout -pubkey | openssl rsa -pubin -outform DER > google.com.der