Rogue CAs can do almost anything, but the browsers will kill any CA that is found to be (repeatedly) mis-issuing. And checking the CAA has apparently been in th

Rogue CAs can do almost anything, but the browsers will kill any CA that is found to be (repeatedly) mis-issuing. And checking the CAA has apparently been in the CA/Browser Forum Baseline Requirements since 2017. That said, LetsEncrypt just had a nasty bug around CAA checking, and ended up not quite revoking all certificates for which insufficient checks had been executed: https://community.letsencrypt.org/t/2020-02-29-caa-rechecking-bug/114591 https://community.letsencrypt.org/t/2020-02-29-caa-recheckin....