It's at least possible to accept only the keys from your real servers, which would stop this attack. For what happens in the real world, see Georgiev et al.'s

It's at least possible to accept only the keys from your real servers, which would stop this attack. For what happens in the real world, see Georgiev et al.'s "The most dangerous code in the world" at https://crypto.stanford.edu/~dabo/pubs/abstracts/ssl-client-bugs.html https://crypto.stanford.edu/~dabo/pubs/abstracts/ssl-client-... (spoiler: I described this paper in our internal knowledgebase as "very readable. Promises lots of facepalming and delivers in spades.")