Pre-cert usage/issuance lists, it would take a keen eye to spot auto-mitm using root certs.