Software Supply Chain
Certificate Transparency
Also: CT logs
Public, append-only logs where certificate authorities must record the certificates they issue so that misissued ones can be spotted.
In more detail
If a forged certificate chains to a trusted CA and the browser requires a log entry, the missing entry gives it away. This protects browsers that enforce it, but not every client, which is why a leaked CA key is still serious outside browsers.