We would still know if certs were issued, though, which is the thing we want to check

How would you know it? If the CA was compromised, why would the attacker publish the fake certificates in CT?

Basically no one outside the major browsers verifies CT logs, so you can still attack a lot of people even without publishing.

	▲	bigbuppo 3 minutes ago \| parent [-]
		The baddies also take a look at the CT logs and look for fresh wordpress instances that haven't yet been configured and will helpfully configure them for you within a few minutes.

hbcdbff 2 hours ago | parent | prev [-]

No we wouldn’t.