If the website is using Let's Encrypt then any subdomains using it will be in certificate transparency logs anyway (until it supports wildcard certificates).
You can go ahead and search the logs yourself through google.
Even where a subscriber specifically didn't want their certs logged and the CA doesn't currently log everything if there's ever a problem it'll get logged. This is because both Google and Mozilla will ask to see all the affected certificates, and logging them is the easiest way to satisfy this requirement. If a CA seems to be trying to dodge this usually participants will take whatever form the CA did provide and upload it to the logs. Google's logs don't care who gives them a cert, they can independently determine that it's authentic so they'll log it.
The option left open by the Chrome team was what's called redaction. The logged document would be partly redacted by for example removing host names.
It's not impossible that redaction will happen and end up being accepted, but its biggest proponent was Symantec, who are exiting the business after destroying trust by not exercising proper oversight on their relationship with Korea's CrossCert. And frankly the redaction proposed was getting ludicrous anyway. The trouble is that people who most want this, as with Brass Plate companies, aren't just looking to avoid excess publicity. What they want is to act entirely with impunity. And that's exactly what CT is there to prevent.
If you want external access you can still use your own CA. I think one can assume that an employee (with an employee device) has the CA installed. If this is a public host or you can't control the employee devices, then use a public cert, or live with the error message.
This is not an unsolvable problem.
> This is not an unsolvable problem.
You literally just did not solve it.
What is the problem?
I think they are the only ones because RFC 6962 does not actually support redaction.
Symantec say they are only submitting these entries to the deneb.ws.symantec.com CT log, but it is possible to cross-post redacted log entries to other CT logs, which actually is happening and is kind of annoying.
You can see an example of a redaction (for nsw.gov.au) here: https://crt.sh/?id=49265178
I think the best way to protect your privacy currently is to purchase wildcards, though LE will support wildcards next year :) !
Kind of related, I also wrote https://ausdomainledger.net/ a couple of weeks ago that is crawling CT logs and Common Crawl as well to enumerate domains in the .au zone, because the zone file is not accessible for the ccTLD.