Certificate Transparency Efficacy

Certificate transparency doesn't solve this issue fully.

So the answer is no, you are unfamiliar with Certificate Transparency. You should check it out! It basically solved this problem a long time ago.

yes? this is a well-known problem, which is why CAA-ACME etc and certificate transparency logs exist.

At some point browsers will stop allowing certificates that are not logged through CT

I believe most (if not all) current browsers require public CAs to use a certificate transparency service to prevent this.

There is Certificate Transparency for that problem. It is on work though.

This is being fixed:• You can use CAA DNS records to choose which CAs can create certs for your domain.• You can watch Certificate Transparency logs to catch CAs that didn't obey.AFAIK both are becoming mandatory for CAs. It doesn't technically stop violations, but ensures they get caught and shut down if they fail to obey the rules (like StartCom and Symantec).

The browser vendors could stop trusting O=ISCA, C=KZ entirely.

Perhaps OS and browser vendors should push out updates that blacklist the certificate?

In addition to what nickf said in the parallel comment, CAs have committed to CT logging as part of being included in browser trust stores. If anyone were to find and report any certificates issued by those CAs via their trusted certificates that were not in CT logs, that would be strong evidence for browsers to remove them from the trust stores, which would essentially destroy their company.