CAs use their private keys to sign website operators' public keys. They don't know the website operators' private keys. Therefore, the only way a rogue CA could

CAs use their private keys to sign website operators' public keys. They don't know the website operators' private keys. Therefore, the only way a rogue CA could intercept traffic is by issuing fake certificates with keys controlled by the attacker, which is what CT aims to detect. Of course, CT doesn't prevent website operators from sharing their private keys with third parties, but the discussion here is about CAs, not website operators.