Sure, they should have checked but I don't see the implication. If you take steps to prove ownership of a domain and then request a certificate for it with a ke

Sure, they should have checked but I don't see the implication. If you take steps to prove ownership of a domain and then request a certificate for it with a key you do not control, that's on you.