On point #2 I would love to be able to be able to use a self-signed certificate and pin it for my extension.

The cert I use for my backend doesn't need to be part of the existing trusted CA infrastructure if I control the clients.