What you've said is true but the attack is much simpler...Who actually checks a certificate? All it needs is a good mock up and the good old "lock" icon (showing us that everything is surely fine?) and it's enough to spoof most people who don't bother looking at the certificate.

Even if you did look, how many people would actually be able to determine if it was a real/fake cert?

It's careless on some peoples part but I would suspect most people are probably still caught in change management....groans