For somebody else to pretend to be then, in this case, they need their private key. As a CA, you can't have your private key leaked and then still be trusted by

For somebody else to pretend to be then, in this case, they need their private key. As a CA, you can't have your private key leaked and then still be trusted by a browser. Or they issued the *.google.com certificate by accident, but if you accidentally issue a certificate as a CA, you can't be trusted by a browser either. IMHO, this was entirely justified.