Should Cloudflare have been monitoring CT logs to spot this earlier?