A MITM attack of this nature would be easy for a website owner to discover.  Just compare the public keys with what a random browser is receiving.<p>Edit: CA operates based on trust.  All it takes is for a single website to demonstrate this is going on for it to quickly become public knowledge.  Now, if you where to target a specific user it might be possible to do this, but hacking their system is a much simpler approach to the same problem with more benefits.