True which kind of excludes the usage of Squid, but that's even more effort because either one specific domain needs to be targeted or a whole cluster of domains. I mean the moment someone finds this out and publishes the public cert that has been used on HN the CA that issued it will be out of business within a month. Afterwards there would be a lot of fuzz and everybody might go all-in on CT.

IMHO the most realistic attack vector in this context is a bug in TLS or a popular implementation that is being leveraged to target an individual. Whoever is in this situation, should seriously consider the way he or she uses the internet...