Presumably the route hijacker wouldn't have a valid private key for the certificate so they wouldn't pass validation