Да, эта система пока не выглядит совершенной.

С одной стороны (https://www.certificate-transparency.org/what-is-ct):
Make it impossible (or at least very difficult) for a CA to issue a SSL certificate for a domain without the certificate being visible to the owner of that domain.
Protect users (as much as possible) from being duped by certificates that were mistakenly or maliciously issued.
И это выглядит хорошо: кому попало не выдаем и юзера как-то защитить пытаемся.

С другой стороны (https://datatracker.ietf.org/doc/rfc6962/?include_text=1):
7.2.  Detection of Misissue
The logs do not themselves detect misissued certificates; they rely instead on interested parties, such as domain owners, to monitor them and take corrective action when a misissue is detected.
Что не выглядит хорошо, ибо это есть попытка возложить функцию контроля на владельца домена.