Hacker News Reader

Absolutely, authentication is not bullet-proof. That's why certificate authorities have to invalidate certificates from time-to-time.

True, and of course they can only revoke the ones they know are fake. And the browser/client has to respect the revocation list.