Comment by dboreham

Assume this is deliberate, since real domain hijackers would use a valid cert. Also helps to ensure browser vendors don't disable cert validity bypass. Very clever.