A miner registrar issues each serial once. Each serial below has more than one valid certificate, so its registrar issued it more than once. The first certificate to mine a block owns the serial, and blocks from the others are rejected. A CRL entry names a serial, so revoking the serial revokes every certificate under it.