code: func (c *Config) Dial(network, addr string) (net.Conn, error) {
  	var conf tls.Config
  	if c.Config != nil {
  		conf = *c.Config
  	}
  	conf.InsecureSkipVerify = true
  
  	cn, err := dialer.Retry.Dial(network, addr)
  	if err != nil {
  		return nil, err
  	}
  
  	conn := Conn{
  		Conn: tls.Client(cn, &conf),
  		Wire: cn,
  	}
  
  	if conf.ServerName == "" {
  		conf.ServerName, _, _ = net.SplitHostPort(addr)
  	}
  
  	if err = conn.Handshake(); err != nil {
  		conn.Close()
  		return nil, err
  	}
  
  	state := conn.ConnectionState()
  	hashFunc := c.Hash
  	if hashFunc == nil {
  		hashFunc = sha256.New
  	}
  	h := hashFunc()
  	h.Write(state.PeerCertificates[0].Raw)
  	if !bytes.Equal(h.Sum(nil), c.Pin) {
  		conn.Close()
  		return nil, ErrPinFailure
  	}
  	return conn, nil
  }
docs: // Dial establishes a TLS connection to addr and checks the peer leaf
  // certificate against the configured pin. The underlying type of the returned
  // net.Conn is a Conn.