Or simply forgetting to renew the domain, at which point an attacker can deliver arbitrary files through correctly signed TLS.