[kevincox]

This doesn't help if your preferred CA does mail-based validation. The attacker can just use the same CA that you do.