Am I correct in thinking that this would not prevent a targeted MITM where an attacker generates a "valid" cert that allows them to serve up a modified response

Am I correct in thinking that this would not prevent a targeted MITM where an attacker generates a "valid" cert that allows them to serve up a modified response for the Twitter and Github public key verification requests (say, providing you with an alternative public key)?