Wonder if he would have caught it if the attacker had gotten a real SSL/TLS certificate.