Oh yeah, CAs have been broken for decades. I remember reporting way back on Room 641A at AT&T having shadow certs.