[pfg]

Certificate Transparency with mandatory SCT delivery (as with EV certificates) will largely solve¹ the issue of fraudulent or compromised CAs.

¹ As long as you're monitoring CT log servers for anything involving domains you own.

[technion]

Obligatory reference to my CT monitoring service:

https://ctadvisor.lolware.net/