True, and of course they can only revoke the ones they know are fake. And the browser/client has to respect the revocation list.