...that's only true while the attacker controls the site. The 90 day window mitigates the effect of the cert being leaked. Just because I grabbed a site's cer

...that's only true while the attacker controls the site. The 90 day window mitigates the effect of the cert being leaked. Just because I grabbed a site's cert on day doesn't mean I control the site. In fact, there's nothing to say I even compromised the site to get the cert in the first place. Perhaps it was mishandled internally? Or grabbed via a heartbleed-style attack?