Actually, your larger companies like Google or Facebook do, in fact, have a certificate. This is a CA-level certificate (able to sign other certificates and thus vouch for those holders' identity) which is either issued by an external CA, or whose public counterpart is registered as being implicitly trusted by OSes, web browsers, etc. Call it the Golden Key.
From this certificate, the company will generate additional "intermediate" certificates. These are also CA-level certificates, which are then used to generate end-level certificates that identify individual servers, endpoints and even internal workstations within the company's "private key infrastructure". Such an infrastructure allows the sysadmin to drastically reduce the amount of his network that has to be "trusted" (in reality such internal communications are only "trusted" because it's considered infeasible to secure them).
If an intermediate certificate is stolen, it's disruptive but usually not the end of the world. An attacker can do a lot with any CA certificate that has an unbroken "trust chain" up to a globally-trusted root. However, as soon as reports of a certificate for Google, signed by one of an unrelated company's intermediate CAs, becomes known, the jig is up; the company will issue a "revocation" of the signed certificate, and if it's believed that the CA has been fully compromised, will revoke the intermediate CA itself. A revocation is kind of an anti-certificate; it's signed in much the same way as a normal certificate, but tells any computer to which it is distributed not to trust certificates with a given signature, or that have been signed with a particular CA certificate. Now, this will revoke trust in all the legitimate certificates as well, which as I said is disruptive, but the company can recover, typically by re-issuing new certificates to all known legitimate certificate owners.
This happens from time to time. Notably, it happened to Comodo, a company whose primary business is issuing certificates to other companies. One of its CA certs was compromised and used to generate fake certificates for Google and other major sites for phishing and other nefarious purposes. As soon as it was clear that only one CA was affected, Comodo revoked that CA, transitioned legitimate certificate holders to new certificates signed by other non-compromised CA keys, then generated a new intermediate CA from its Golden Key to replace the revoked one, and it was back to business as usual.
If the Root Certificate, the Golden Key, of a company is stolen, that's the end of the world, for the company holding it at least. Root CA certificates are among the most valuable things in the hacker underworld. As such, there is usually an extreme level of security inherent in the storage of any device which holds the Golden Key (typically a Hardware Security Module). You can watch this video, showing just some of the rigamarole behind the generation and storage of the Root CA certificate for the DnsSec extensions to DNS, which add proof of origin and denial of existence capabilities to the standard DNS framework. If a Golden Certificate is believed to be compromised, everything underneath it in the hierarchy is suspect; there's no way to prove or disprove the legitimacy of any certificate signed by it. Therefore, the only thing you can do is revoke trust in that root certificate completely and deal with the fallout.
This is much rarer, but it has happened. DigiNotar, a Dutch root CA company similar to Comodo, was the victim of multiple attacks that compromised the company's trusted root certificate; the private key was then used to generate fake certificates for a number of major websites. DigiNotar could not reliably identify all the fakes, could not therefore guarantee they had all been revoked, and could not even guarantee that its root private key had not been copied offsite. As a result, the major OS and browser writers responded by simply revoking trust in DigiNotar's root certificate altogether. Hilarity ensued, as DigiNotar was the root CA for several Dutch Government websites, including the counterpart to the U.S. IRS. Imagine going to www.irs.gov and being told by your browser that the site may be fraudulent; that's exactly what happened to visitors of the Dutch Tax and Customs Administration website. The Dutch government quickly assumed control of DigiNotar's intermediate CAs, and transitioned all their sites to other certificate authorities. DigiNotar had filed for bankruptcy by the end of the same month.