They would have gotten a valid certificate that couldn&#x27;t be tied in anyway to their identity.<p>Coupled with e.g. a XSS vuln on a secured website, you could serve a nasty browser exploiting payload from a secure site, without any warning such as &quot;this page is trying to load stuff from an unsecure site&quot;.<p>This in only one scenario, there are others. This really was pretty bad.