So he suggests to have users connect to (a) attacker's server (b) using attacker's public key for authentication. That's from the same domain as planting a fak

So he suggests to have users connect to (a) attacker's server (b) using attacker's public key for authentication. That's from the same domain as planting a fake CA cert on the client and then proxying its SSL connections.