It turns out my test was invalid: I had launched a VM to test, which turns out had an old Chromium installed (via the system package manager, so not self-updat

It turns out my test was invalid: I had launched a VM to test, which turns out had an old Chromium installed (via the system package manager, so not self-updating). Chromium disables CT checking if it doesn't have an updated list of CT logs (either by component-updater or updating chrome itself). I see ERR_CERTIFICATE_TRANSPARENCY_REQUIRED after updating.