essentially, they would be MITMing the connection and presenting an SSL cert issued by DigiNotar (instead of the actual CA that issued the cert to *.google.com)

essentially, they would be MITMing the connection and presenting an SSL cert issued by DigiNotar (instead of the actual CA that issued the cert to *.google.com). because the compromised CA is in the browser's trusted CAs list, it probably produces no user-visible warning.