This bleeds into Information Security Exchange, however I am posting it here:
Suppose I am extremely paranoid and want to ensure my Pis only connect to WiFi access points with a certificate signed by my own home brewed CA (i.e. I created my own root CA certificate, and then signed a certificate with that).
How would I do this? How do I tell the Pi "connect to this SSID, and if the cert isn't signed by this CA, abort"?