i assume this would be done by looking at the issuing date of the cert and rejecting certs with issuing date > date CA was 'executed'. however, a CA could just

i assume this would be done by looking at the issuing date of the cert and rejecting certs with issuing date > date CA was 'executed'. however, a CA could just issue certificates with the issuing date in the past. they probably wouldn't do this for real customers because it would be detected easily. however, they could do it for fraudulent customers and it would be a massive temptation for CAs who have no other source of revenue to do this.