In other news, water is wet. This is exactly working as intended. If I control the website superawesomepaypalscam.com then I should be able to get a DV (domain validated, it's in the name) SSL certificate for it. It doesn't matter what I intend to use the website for.