Comment by mholt

Even without CT, you're still setting public DNS records -- so better yet, don't rely on "internal" hostnames staying private if you want them publicly trusted. Full stop.