These kind of things are part of transparency log threat models, for example: https://www.rfc-editor.org/rfc/rfc6962.html#page-24.