Self signed certificates are always less valuable than purchased ones. The worst case CA breach is equivalent to the normal case of self-signed certificates: a

Self signed certificates are always less valuable than purchased ones. The worst case CA breach is equivalent to the normal case of self-signed certificates: a certificate is misissued and an attacker can carry out an active MITM attack. A CA breach cannot enable passive attacks because they don't know the private keys of certificates used by websites.