[thayne]

All such certs should be in transparancy logs, so I think it should be possible for a third party to verify.

[agwa]

Random third parties can't verify if domain validation was performed properly; only the domain owner knows. Which is why domain owners should monitor Certificate Transparency logs: https://certificate.transparency.dev/monitors/