That's in this spec:
"The server certificate, if one is proffered by the alternative service, is not necessarily checked for validity, expiration, issuance by a trusted certificate authority or matched against the name in the URI."
In other words, the certificate presented is merely used to secure the connection against a passive attacker.
I would love to have certificates for all of my domains, but it simply isn't worth it to me for the 40 - 50 hits a month I get on those properties to pay for a cert, or go through the hassle of StartSSL and worry about having to pay if the next Heartbleed happens.