That's why browsers pin the certificates of certain sites.