Also, CAA is explicitly specified to only constrain certificate issuance, not certificate acceptance. Only the issuing CA is supposed to check it, not the brows

Also, CAA is explicitly specified to only constrain certificate issuance, not certificate acceptance. Only the issuing CA is supposed to check it, not the browser. RFC 8659: A set of CAA records describes only current grants of authority to issue certificates for the corresponding DNS domain name. Since certificates are valid for a period of time, it is possible that a certificate that is not conformant with the CAA records currently published was conformant with the CAA records published at the time that the certificate was issued. Relying Parties MUST NOT use CAA records as part of certificate validation.