3 ms·

Yes, but the hijacker will still need to present a valid cert for that domain, which is much harder.