Ok, yeah, I hadn't thought about the certificate issue phase, though that's a different concern than what you talked about initially. The victim in the paper y

Ok, yeah, I hadn't thought about the certificate issue phase, though that's a different concern than what you talked about initially. The victim in the paper you mention aren't users but rather the CAs themselves (though the certificates issued can then be used against users)