You could mitigate this by monitoring certificate transparency logs for unwanted certificates issued for your domain. Currently there are no good monitors thou

You could mitigate this by monitoring certificate transparency logs for unwanted certificates issued for your domain. Currently there are no good monitors though aka the system is a bit broken.