They can issue any cert they like, but these days browsers also require that certs are written to certificate transparency logs to be trusted, and if they did t

They can issue any cert they like, but these days browsers also require that certs are written to certificate transparency logs to be trusted, and if they did that it would be detected immediately. I don't think using curl and openssl directly check CT, though....