According to here[0], when you say: CT would create an open, unalterable record of every cert published from all of these roots and their subordinates.

According to here[0], when you say: CT would create an open, unalterable record of every cert published from all of these roots and their subordinates. That provides no substantiation for Google's push to be a Certificate Authority (CA). It arguably makes a case for Google to be a "Log Server" (which has its own troubling implications as that could then (now?) hook Google into the verification process of every certificate issued[1]). But absolutely nothing about CT needs/implies/warrants Google to become a CA. Given Google's strong push for making those mandatory, I'm far more worried about a lot of the CAs already in my trust store than I am about these. The very authority to which you are appealing is precisely the one which is suspect. 0 - https://www.certificate-transparency.org/how-ct-works https://www.certificate-transparency.org/how-ct-works 1 - From [0]: During the TLS handshake, the TLS client receives the SSL certificate and the certificate’s SCT. As usual, the TLS client validates the certificate and its signature chain. In addition, the TLS client validates the log’s signature on the SCT ...