I'd hope that people can get certs for their actual business name, but sometimes it does differ yes.

However remember that signing in BIP70 is about more than just security, though that's the driving factor. It's also needed for things like dispute mediation, receipts, etc.