> to someone who has demonstrated control on visa.com at the time the cert was issued

And who still has access to receive traffic for the visa.com domain after it hits cloudflare. This is a much higher bar.