- Don't just check the certs you want to verify, but also check others, and publish your findings.

- Check with multiple alternative systems, so that the chance of

- Allow users to assign trust to third party monitors that checks the logs.

Rotating certs is not really a different problem than issuing it in the first place - it just requires you to not trust a cert indefinitely.