The CT Logs were a solution to the problem of miss-issuance being essentially undetectable, and shorter certificate lifetimes were the solution to the frustrati

The CT Logs were a solution to the problem of miss-issuance being essentially undetectable, and shorter certificate lifetimes were the solution to the frustrating fail-open behavior of the revocation mechanism[s]. The other advantage is that OCSP was a privacy nightmare, as it required broadcasting every site you visited just on the off chance a cert was revoked. Unsurprisingly there's quite an incentive to monetize those queries. The specific problem in this post is that the log servers are occasionally down, which is obviously suboptimal, but was also a predicted and understood problem, which is why every client is expected to require that any certificate that they validate is signed by multiple (I think >= 3? but that was also years ago) unrelated log services. Client validation is essentially are these log tokens valid - revocation checking a la OCSP is still essentially useless in practice, and I think some vendors monitor for revocations and construct their own revocation lists for all their CAs that their clients pull. The notable thing point being that their clients aren't pulling per domain, they're getting the full list of all revocations. I assume actual implementations do some kind of partial/delta updates (you could imagine "entire DB" and "last N hours" or something)