The Web PKI uses certificate transparency, so we’ll have a definitive answer about whether this is/was exploited soon.

(But in any case, CT ensures that it can’t be “quiet.”)

A grumpy state actor today.

Nope. You can find this from the Chrome Root Program.

> Because no TLS certificates chaining to these six intermediate CAs were logged to CT prior to our CRLSet block on October 17, no fraudulent certificates issued by these CAs could have been trusted by default in Chrome or other CT-enforcing browsers.