I'm currently implementing the [TrustKit framework](https://github.com/datatheorem/TrustKit) in my iOS app to enable SPKI pinning for SSL connections.
I'm stumbling upon the "backup pin" which is mandatory for a correct TrustKit configuration. Unfortunately the API documentation only states that a backup pin is needed but it doesn't tell me what it should be. The chain of trust looks like this:

```
GeoTrust Global CA
| GeoTrust SSL CA - G3
   | myServer.com

```

So I pin the SPKI hash for myServer.com-certificate as the primary pin. What is my backup pin?

Unfortunately I didn't find a lot of information about this topic. One of the few resources I found is [this article](https://www.paypal-engineering.com/tag/trustkit/) by Hubert Le Van Gong from PayPal. He says about backup pins:

*"Whatever the number of pin values, a backup pin is an absolute must-have. Note that the existence of a backup pin is a mandate in HPKP (i.e. for the web case) but it is equally important in the mobile app space. In both cases, the key pair corresponding to the backup pin should be kept offline until an issue arises with the primary pin/key."*

I especially don't get the part with "should be kept offline".

About the question what to pin:

*Root CA certificate are probably best. Therefore, when pinning to multiple values (e.g. 2), intermediate CA – root CA is a sound approach in my opinion. That said, it is also perfectly OK to only pin to a single certificate as long as that certificate is a root CA.*

From this I understand my backup pin could be the root CA (it's SPKI hash to be exact). However I wonder how an intermediate or even root CA can be good pins. From my understanding this would validate the pinning for every certificate that has this intermediate/root CA in it's chain.

What am I getting wrong here?