How does the CA validate that the plaintiff's client's sites don't match that criteria? Should they take the plaintiff's lawyer's word for it? You can't really

How does the CA validate that the plaintiff's client's sites don't match that criteria? Should they take the plaintiff's lawyer's word for it? You can't really go off script with stuff like this, there's too many gotchas that you need to think through. I wonder if we could come up with a process where a customer could push another DNS record to redo the verification. They'd need to act fast to beat the 24 hour revocation window, but maybe that's better than a full re-issuance? Probably better to invest in re-issuance agility though.