> and they can then generate their own valid certs, completely disconnected from CT Aren't browsers now requiring that certificates from many CAs (if not all o

> and they can then generate their own valid certs, completely disconnected from CT Aren't browsers now requiring that certificates from many CAs (if not all of them) are submitted to CT before they are accepted as valid by the browser? That is, a certificate without an attached CT proof, even if it has a valid signature from the CA, will be treated as invalid. (However, given what's being talked about (MITM of software update servers), this might be enough if the libraries being used by the software updater are not as strict as the browsers, and don't require an attached CT proof.)