I'm wondering if and how the current public key certificate infrastructure is guarded against the following scenario:

• Honest Alice obtains Eve's public key certificate Cert_e, made by honest CA Carol; checks it the usual way; and assumes she knows Eve's public kev Pub_e.
• Alice generates a message M mentioning obligation by Eve, sends it towards Eve, and receives apparently from Eve a signature S; Alice verifies that M, S, and Pub_e match.
• Later, Eve denies having approved M or produced S; suggests that S must be by Frida; and as argument asserts that S also checks against Frida's certified public key.
• Alice obtain Frida's public key certificate Cert_f, made by honest CA Carl; checks it the usual way; and assumes she knows Frida's public key Pub_f.
• Alice verifies that indeed M, S, and Pub_f match!
• Pub_e and Pub_f are different, and Alice finds them unremarkable, as well as Cert_e and Cert_f; these carry a certification date earlier than the generation of M by Alice; there was no certificate revocation.
• Alice obtains other (M, S) pairs attributed to Eve and Frida; they verify against only one of Pub_e or Pub_f, as intended.

Unless I err, that scenario could happen with 2048-bit RSA, usual e=F₄=65537, and RSASSA-PSS as signature, assuming Eve and Frida are crooks operating as follows:

• Eve and Frida jointly choose two distinct small close primes, say r_e=101 and r_f=103; and jointly generate their respective RSA modulus N_e and N_f with N_e=r_e⋅p⋅q, N_f=r_f⋅p⋅q, 2²⁰⁴⁷<N_e<N_f<2²⁰⁴⁸, p and q large random primes with gcd(p-1,65537)=1=gcd(q-1,65537).
• Eve computes her private exponent d_e=e^-1 mod LCM(r_e-1,p-1,q-1) matching her public key Pub_e=(N_e,e) with e=65537. Frida does similarly for d_f matching her public key Pub_f=(N_f,e).
• Eve and Frida obtain their certificate the normal way; the only caveat is that they avoid CAs that check for small factors in public modulus.
• When Eve generates a signature using RSASSA-PSS, she proceeds normally, except that she additionally checks the signature against Pub_f: about one signature among r_f pass this test! Eve iterates signing until finding a signature for M matching her intention to later attribute the signature to Frida, or not. Frida does similarly.

I'm wondering if and how the current public key certificate infrastructure is guarded against the following scenario:

• Honest Alice obtains Eve's public key certificate Cert_e, made by honest CA Carol; checks it the usual way; and assumes she knows Eve's public kev Pub_e.
• Alice generates a message M mentioning obligation by Eve, sends it towards Eve, and receives apparently from Eve a signature S; Alice verifies that M, S, and Pub_e match.
• Later, Eve denies having approved M or produced S; suggests that S must be by Frida; and as argument asserts that S also checks against Frida's certified public key.
• Alice obtain Frida's public key certificate Cert_f, made by honest CA Carl; checks it the usual way; and assumes she knows Frida's public key Pub_f.
• Alice verifies that indeed M, S, and Pub_f match!
• Pub_e and Pub_f are different, and Alice finds them unremarkable, as well as Cert_e and Cert_f; these carry a certification date earlier than the generation of M by Alice; there was no certificate revocation.
• Alice obtains other (M, S) pairs attributed to Eve and Frida; they verify against only one of Pub_e or Pub_f, as intended.

Unless I err, that scenario could happen with 2048-bit RSA, usual e=F₄=65537, and RSASSA-PSS as signature, assuming Eve and Frida are crooks operating as follows:

• Eve and Frida jointly choose two distinct small close primes, say r_e=101 and r_f=103; and jointly generate their respective RSA modulus N_e and N_f with N_e=r_e⋅p⋅q, N_f=r_f⋅p⋅q, 2²⁰⁴⁷<N_e<N_f<2²⁰⁴⁸, p and q large random primes with gcd(p-1,65537)=1=gcd(q-1,65537).
• Eve computes her private exponent d_e=e^-1 mod LCM(r_e-1,p-1,q-1) matching her public key Pub_e=(N_e,e) with e=65537. Frida does similarly for d_f matching her public key Pub_f=(N_f,e).
• Eve and Frida obtain their certificate the normal way; the only caveat is that they avoid CAs that check for small factors in public modulus.
• When Eve generates a signature using RSASSA-PSS, she proceeds normally, except that she additionally checks the signature against Pub_f: about one signature among r_f pass this test! Eve iterates signing until finding a signature for M matching her intention to later attribute the signature to Frida, or not. Frida does similarly.

Update: I asked again there, where questions about policies belong.