Maybe CAs should spend a few thousand CPU hours trying to crack submitted intermediates before actually signing them.