Comment by coffee--

This is where Certificate Transparency -- and it being mandatory for browser trust -- comes in to save the day.