Yes but then you need to spoof it to the CA itself which is harder. They also publish every cert they sign in transparency logs so the owner can monitor for any

Yes but then you need to spoof it to the CA itself which is harder. They also publish every cert they sign in transparency logs so the owner can monitor for any funky business