The idea of Convergence is that Truth is what the whole world sees. Your Firefox add-on shall ask several notaries, and declare itself content with the certificate if what your Firefox sees is also what all the notaries see (and they also find the certificate "reasonable", e.g. fulfils X.509 validation requirements).
In your scenario, the attacker got a "reasonable" certificate (the CA was hacked into signing it, so it is fine as per X.509 rules -- at least until the CA gets back to its senses and revokes it) with, as name, the name of a target server that the attacker wants to impersonate. The postulate of Convergence is that worldwide impersonation is hard. The attacker may succeed in intercepting calls to the true server, as long as these calls come from a restricted list of "victim clients" who are behind routers that the attacker controls. The idea is that the wider the list of victim clients, the more conspicuous the attack gets; ultimately, the attacker cannot maintain for long an interception such that all notaries will be fooled, because it would require taking over the whole Internet. Thus, by asking several notaries, you have a good chance that at least one notary will not be in the subnetworks that the attacker can fool, and the attack will be revealed.
At least so goes the theory. There are a number of faith items in this setup.
So Convergence should allow the detection of fake phishing sites which impersonate real servers, even if the fake sites got a seemingly valid certificate from a gullible CA. That's the goal. It relies on a number of heuristics, including the existence of many notaries, and some assumptions on network topology and average attacker's power.
Of course, this does not help in any way against phishing sites with close names (e.g. a site called "www.stackxechange.com"). For these, the best defence is the user's brain and common sense (I say "best" because that's the only one; "best" does not always imply "good").