Catching one of these forged certs "in the wild" is harder if it only ever appears on the targets connection. If they happen to be anyone other than the fracti

Catching one of these forged certs "in the wild" is harder if it only ever appears on the targets connection. If they happen to be anyone other than the fraction of a percent of users who understand things like "pinning", it is very low risk (today at least). The ability to generate a CA cert trusted by a consumer CA store is a valuable asset that, like any intel asset, must be rationally deployed.