How does one bypass certificate transparency? I tend to exclude state actors from my threat models (1. they tend to be the all-powerful boogeyman that bypasses

How does one bypass certificate transparency? I tend to exclude state actors from my threat models (1. they tend to be the all-powerful boogeyman that bypasses all threat models anyways, and 2. I doubt that the NSA is going to get you by way of coffee shop wifi) but I'm actually struggling to see how even they would bypass this particular protection; if Chrome only trusts CT-logged certs, even a targeted one-off is likely to be discovered (albeit, AIUI, after the fact).