It is a specific component of the CT protocol that the CT server will only accept certificates signed by a CA that it trusts. Google actually launched a separa

It is a specific component of the CT protocol that the CT server will only accept certificates signed by a CA that it trusts. Google actually launched a separate CT log which allowed certain CAs that aren't usually "trusted", but still only from a specific list: https://security.googleblog.com/2016/03/certificate-transparency-for-untrusted.html https://security.googleblog.com/2016/03/certificate-transpar... Edit: Section 3.1 of the CT RFC: the log SHALL publish a list of acceptable root certificates ... Logs MUST verify that the submitted end-entity certificate or Precertificate has a valid signature chain leading back to a trusted root CA certificate