NetSPI's security consultants publish penetration testing techniques for SSH, PowerShell, SQL Server, SAML, and Android.
HN links it as a reference for specific attacks, like stealing SSH-agent keys from memory and bypassing the PowerShell execution policy.
HPKP is what the article you posted to is referring to, and probably will go away completely.
However, profiling the public key of the site a mobile app connects to and erroring out if it is compromised to prevent MitM attacks is called 'certificate pinning' for mobile apps but is not related to the HPKP pinning of browsers. A reference for certificate pinning: https://blog.netspi.com/certificate-pinning-in-a-mobile-application/
Originally, Powershell did NOT have execution policy. And even in versions that do, it's also at the mercy of the invoking process, as I recall.
Which is why he specifically said "powershell embeds without any security warning", I suspect. :|
https://blog.netspi.com/15-ways-to-bypass-the-powershell-execution-policy/
I would argue that the key element is extracting a useful key which appears to have been made possible by an earlier blog from another source (referenced by this blog entry): https://blog.netspi.com/stealing-unencrypted-ssh-agent-keys-from-memory/
Useful reading:
https://blog.netspi.com/stealing-unencrypted-ssh-agent-keys-from-memory/
https://blog.ropnop.com/extracting-ssh-private-keys-from-windows-10-ssh-agent/
If it really needs that, https://blog.netspi.com/15-ways-to-bypass-the-powershell-execution-policy/