Comment by JoshTriplett

I use and like StartCom certificates, but they wouldn't solve this problem. Wildcard certificates should not require identity validation; you should be able to get a domain-validated wildcard certificate for free.

Also, their free certificates expire every year; domain-validated certificates should only require revalidation if the domain changes hands.