Depends on the level of automation possible in deploying a wide-scale attack, too.

Run some scripts, check on it six months later...oh look, we have SSL private keys for the X domains now.