No, to exploit this, you just need to either 1) work inside a CA, 2) be a spy and infiltrate the CA, 3) use your nation-state powers to force a CA in your borde

No, to exploit this, you just need to either 1) work inside a CA, 2) be a spy and infiltrate the CA, 3) use your nation-state powers to force a CA in your borders to do what you want, or 4) be a clever hacker hack a CA. There are "only" 330 different complex organizations in probably a hundred-plus countries to try, so I guess this is pretty unlikely. But even if it is, you can actually hack the entire system with just a BGP hack. Today, if you issue some false BGP routes, you can MITM LetsEncrypt (or one of the other 329 CAs) to sign a valid cert for you. It's not hard because validation is automated and depends on proving you own IP space... and IP space is just what your router's BGP table says it is at the moment you issue a cert. I would not depend on the kindness of banks giving back money on very large scales. They care about themselves more than they care about you. You're right, DNS registrar and nameserver attack is another great attack and usually they're pretty vulnerable, so that's another good option.