I think I might just be talking past you. If your point is "anyone with these broken eMudhra keys can attack users without caring about CT", that's totally true --- it's just that browser/no-browser doesn't factor into it. I'm really only on this subthread because of the notion that CT enforcement requires browsers.

▲

tux3 2 hours ago | parent [-]

Right, I think I'm with you that browser/no browser shouldn't be a factor. I think I'd like to hear from Rust and Go webpki people on whether we could help the ecosystem enforce CT.

My point is more that as a user of a high-level library like reqwest, I'd like to talk safer defaults when root CAs are in use

	▲	tptacek an hour ago \| parent [-]
		Right, OK, I was misunderstanding the point you were making. Thanks!