For a CA they could structure their data as a log where each entry (new cert) contains the checksum of the previous entry. That way it's not possible to change

For a CA they could structure their data as a log where each entry (new cert) contains the checksum of the previous entry. That way it's not possible to change the chain without unwinding it. Each person getting a new signed cert now has the new HEAD of the log and unwinding means revoking all these certificates. Now if you put multiple CAs in the game it start to become interesting to use a distributed ledger like the blockchain. If all the signed certs are distributed as part of the ledger it becomes easier to track who issues certs for what domain. Something we cannot do with the current SSL CA system.