You are right. To be clear, I implicitly assumed that people I talk to wouldn't accept a fake certificate.