You might want to add a second, known backup key to the list such that the app still works should the server become compromised and the SSL cert need to be replaced. There's no guarantee that a newly issued cert will have the same intermediate cert.