> then the authentication token they send to the real google will have the correct signature, but the wrong domain name.

So a domain hijacking attack is the only possibility? (and made drastically harder for serious websites with Certificate pinning)