feat: extend certificate pinning to all TLS protocols and add SSH

host-key pinning

docs/protocols.md

@@ -78,6 +78,7 @@ Custom FTP implementation supporting active and passive modes.
 - **Explicit TLS (FTPS)** — AUTH TLS command on port 21
 - **Resume** — REST command for partial transfers
 - **Directory listing** — For recursive operations
+- **Certificate pinning** — `--pinned-cert` enforces a SHA-256 leaf-cert match on FTPS connections
 
 ### Limitations
 
@@ -95,6 +96,9 @@ Custom FTP implementation supporting active and passive modes.
 
 # Anonymous (default)
 --url ftp://anonymous@ftp.example.com/file.zip
+
+# Certificate pinning (FTPS only)
+--url ftps://ftp.example.com/file.zip --pinned-cert a1b2c3d4e5f6...
 ```
 
 ## SFTP (`sftp://`)
@@ -108,6 +112,7 @@ SFTP over SSH protocol.
 - **Known hosts verification** — Via `~/.ssh/known_hosts`
 - **Resume** — Partial transfer support; parallel recursive downloads available via `--recursive-parallel N` with connection pooling
 - **`known_hosts` verification** — Reads `~/.ssh/known_hosts`; does not write to it. First-connection accept via `--ssh-insecure`
+- **Host-key pinning** — `--pinned-host-key` enforces an exact SSH host-key match (takes precedence over `--ssh-insecure` and `known_hosts`)
 
 ### Configuration
 
@@ -123,6 +128,9 @@ SFTP over SSH protocol.
 
 # With password
 --url sftp://user@host:/path/to/file.zip --password "secret"
+
+# Host-key pinning (OpenSSH fingerprint from ssh-keygen -lf)
+--url sftp://user@host:/path/to/file.zip --pinned-host-key SHA256:AAAAC3NzaC1lZDI1NTE5AAAAIE...
 ```
 
 ## Local File (`file://`)
@@ -202,6 +210,7 @@ Implements the Gemini protocol (a lightweight alternative to HTTP/HTTPS).
 - **Redirect following** — Respects Gemini redirect status codes (3x), up to 10 redirects
 - **Error handling** — Input prompts (1x) return an error with the prompt text; temporary (4x) and permanent (5x) failures are handled
 - **Text and binary downloads** — 2x success responses stream content directly
+- **Certificate pinning** — `--pinned-cert` enforces a SHA-256 leaf-cert match
 
 ### Limitations
 
@@ -217,6 +226,9 @@ goget --url gemini://gemini.example.com/file.zip
 
 # Browse a capsule
 goget --url gemini://gemini.example.com/
+
+# Pin the server certificate
+goget --url gemini://gemini.example.com/ --pinned-cert a1b2c3d4e5f6...
 ```
 
 ## Protocol Resolution Flow