Same way they do other verifications I suppose; by proving you have write access to the server in question. If someone malicious can manage that, there's bigger

Same way they do other verifications I suppose; by proving you have write access to the server in question. If someone malicious can manage that, there's bigger problems than SSL.