how would browser vendors deal with $O(10^k)$ fake certs?

[Georgi Guninski <guninski () guninski com>]

how would browser vendors deal with $O(10^k)$ fake certs?

recently, most browser vendors panicly issued binary updates because of $O(10^1)$ fake server certs.

what does analytic number theory says about replacing the constant $1$ by a variable $k$?

i.e.:

what would do most browser vendors do if they find $O(10^k)$ fake server certs (possibly from different RA) {one assume 
$k$ is not **that** big} [god forbid CA certs]?

appears to me getting the certs is one time cost to the attacker, while checking 10^k c3rt s3r34l numbers (as in the 
panic patch) requires loop to 10^k?

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/