Once the CA attaches the public key to a hostname, it signs the SSL certificate with its own intermediate root certificate's private key. This means that the CA vouches for the authenticity of the SSL certificate. The web browser simply checks the CA's signature from its trusted root store and trusts the certificate and the details it contains. Hence, if the CA makes a mistake in attaching the keys, and if someone suffers from the financial loss due to such a mistake, the CA must reimburse the legal penalty up to the warranty amount to the victim.