Sure, but I’m only worried about CAs that exist in root trust stores, and a CA that ignores CAA records has two options:
1. Publish a CT record and tattle on themselves when they issue
2. Don’t publish a CT record and tattle on themselves when they try to use the cert
Either one ends with them getting the boot from the root trust stores. There’s very few folks out there whose adversaries are willing to burn an entire root-trusted CA to attack.
1. Publish a CT record and tattle on themselves when they issue
2. Don’t publish a CT record and tattle on themselves when they try to use the cert
Either one ends with them getting the boot from the root trust stores. There’s very few folks out there whose adversaries are willing to burn an entire root-trusted CA to attack.