That paper is from April 2010 which is a different age in terms of internet encryption. Just for comparison, Google only started offering an encrypted version o

That paper is from April 2010 which is a different age in terms of internet encryption. Just for comparison, Google only started offering an encrypted version of its service in May 2010: https://googleblog.blogspot.com/2010/05/search-more-securely-with-encrypted.html https://googleblog.blogspot.com/2010/05/search-more-securely... They quickly realized the problems that you describe. In Nov 2011, the Certificate Transparency project by Google had its initial commit: https://github.com/google/certificate-transparency/commit/6afe823685a7526e0927db90b037c298dfabea95 https://github.com/google/certificate-transparency/commit/6a... In Chrome they have since enforced CT compliance for certificates: https://groups.google.com/a/chromium.org/forum/#!msg/ct-policy/wHILiYf31DE/iMFmpMEkAQAJ https://groups.google.com/a/chromium.org/forum/#!msg/ct-poli... CT requires that each certificate issued needs to be contained in both a Google log and a non-Google log: https://github.com/chromium/ct-policy/blob/master/ct_policy.md https://github.com/chromium/ct-policy/blob/master/ct_policy.... This means that fradulently issued certificates either won't work, or will be contained in public logs run by Google (or Google needs to be forced by authorities as well).