> This upper bar on security may even ban browsers from enforcing Certificate Transparency, an IETF technical standard that ensures a CA’s issuing history can be examined by the public in order to detect malfeasance.
I don't quite understand that. How does a browser enforce CT? Even if a browser queries CT logs, they're not that helpful without any context, right? How would a browser get anything useful from the logs beyond knowing a certificate was published to the logs?
Isn't it the job of the domain owner to monitor those logs since they're the only one that's going to know definitively if a certificate is illegitimate?
I don't quite understand that. How does a browser enforce CT? Even if a browser queries CT logs, they're not that helpful without any context, right? How would a browser get anything useful from the logs beyond knowing a certificate was published to the logs?
Isn't it the job of the domain owner to monitor those logs since they're the only one that's going to know definitively if a certificate is illegitimate?