The problem is that those classes of wrongness are treated identically when they are emphatically not: scary, hard-to-understand-by-users warnings, if not outri

The problem is that those classes of wrongness are treated identically when they are emphatically not: scary, hard-to-understand-by-users warnings, if not outright inability to connect in some cases. A cert that's a day out of its expiration time has zero implications to the confidentiality and identity of the parties to the connection. The same cannot be said about a bad CN or signature.