If you combined these evil SSL certs with the right BGP hijack, you could read a lot of people's email and such. And since reading mail lets you reset passwords on everything else, he could have basically owned millions of people.
BGP, or DNS, or your DSL modem or cable modem, or an open access point, or the router in an internet cafe, or...