The malicious cert would presumably only be used against specific targets, reducing the chance that an auditor gets to see it. But indeed, an SCT and a later t

The malicious cert would presumably only be used against specific targets, reducing the chance that an auditor gets to see it. But indeed, an SCT and a later timestamp on the log without having logged the cert would be the cryptographic evidence I talked about.