https://en.wikipedia.org/wiki/Certificate_Transparency
to make it more visible if unreasonable but valid and trusted certificates (eg, a trusted Russian CA signed cert for google.com) are seen.
Sites can tell browsers what CA they should expect from that site
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Ex...
if something else is seen, it tells the browser where to report it. This helps but if the attacker controls the victim routing it can suppress the reports.
Browsers ship trusting pretty much every country's CAs at the moment, which is convenient. If CAs are found to be mis-issuing certs, they will get distrusted from the browsers, which has happened several times already. But in wartime, they are not going to care about that if they can inflict massive damage first.