> EV certs would still satisfy nonrepudiation, in a way. You'd have to be pretty bold to run a phishing site under a company registered in your targets' country under your legal name.
I don't think that would be the failure mode. It'd be a phishing site that uses a compromised EV cert issued for an obscure small bank in a far away country purporting to be a major brand bank in your own country, taking advantage of the asymmetry in cybersecurity budget between those two entities. Users would have to actually check the EV cert DN every time (unlikely so successful for a phisher then) or rely on things orthogonal to EV certs like pinning.
I don't think that would be the failure mode. It'd be a phishing site that uses a compromised EV cert issued for an obscure small bank in a far away country purporting to be a major brand bank in your own country, taking advantage of the asymmetry in cybersecurity budget between those two entities. Users would have to actually check the EV cert DN every time (unlikely so successful for a phisher then) or rely on things orthogonal to EV certs like pinning.