Whoever has access to the private key used by a SSL server has the technical power to:
- Impersonate any server with a name matching that which is inscribed in the certificate.
- Decrypt sessions which have been passively eavesdropped (unless the SSL session uses one of the "DHE" cipher suites which provide perfect forward secrecy, but such suites are rarely selected by default, someone must configure them explicitly).
So giving the same private key to many people is really trusting them all, and making them trust each other. Remember that "someone you trust" is an expression which really means "someone who has the power to betray you".
On a general basis, once a secret value is known by more than two people, then it is no longer secret, only kinda discreet. Also, you cannot force forgetfulness, so if your client S wants to cease doing business with one of the vendors to which S gave a copy of the private key, they have to cancel the whole thing (revoke the certificate, create a new one with a new key, and distribute it) -- alternatively, S can go one level up on the scale of gullibility, and just assume that everybody is honest and competent, and that vendors with which they no longer have any business relationship will nonetheless take care of their private key, not having it leaked through a backup tape or an indelicate intern.
Also, support for wildcard certificates is known to be a bit flaky, since they have historically been a source of trouble (not per se, but they amplify the power of nuisance of an evildoer who gets to steal the corresponding private key). Browser vendors tend to restrict them in arbitrary and changing ways.
There are CAs who provide SSL server certificates for free. How cheap do you have to be, to find free certificates too expensive ?