By proving control of the domain, there is a link between the certificate and the person asking for it thru the registrar. And thru the payment information to t

By proving control of the domain, there is a link between the certificate and the person asking for it thru the registrar. And thru the payment information to the registrar, you can usually get to someone. It's a tenuous link, but a lot better than no link at all. At times enough for law enforcement to follow the tracks. (edit since we reached maximum comment depth) Control of an IP address doesn't mean trackable ownership of it, you could use any machine your just compromised and instantly have a valid certificate for it. Delays in certificate issue add a thin layer of security, even if you gained unlegitimate control of a domain, the interval before asking and getting a certificate offers an opportunity for the intrusion to be detected and remediated. Instant valid certificate for any IP address you happen to compromise is really quite bad.