Regardless of whether or not it was misused, the user is legally responsible. There are authorities on DNS name assignments, but none of the SSL CAs is such an authority. That means that the DNS name in the certificate is not an authoritative statement. There are authorities on corporate names, but none for SSLs - CAs can act as such an authority. Under SSO, the user's account becomes vulnerable if the sign on location is left unattended.
Security is a chain, and only as strong as the weakest link.
The security of any CA-based system depends on many links, and they're not all cryptographic. The Counterpane report concludes that security is difficult both to understand and to implement, and system administrators and IT managers do not have the time or resources to learn more about the intricacies of security technology. Reality falls far short of this promise - that is the caveat emptor. PKI definitely appeals to users, particularly those managing an ecommerce strategy. Electronic Passports Certification authorities are the equivalent of electronic passport offices.