The table separating what CAA helps with from what CT monitoring helps with is useful, especially the stolen-key row where neither does anything. One suggestion on the accounturi plus validationmethods=dns-01 example is to check how it interacts with any CNAME-delegated _acme-challenge records, since the restriction only holds if you control who can edit that delegated zone. Because CAA is only checked at issuance time and CAs cache it for up to the record TTL, a long TTL can delay a lockdown after you discover a problem, so a shorter TTL while rolling out seems wise. On the monitoring side, it may be worth alerting on certificates for your names from issuers outside the CAA set, since that combination points to either a CA that ignores CAA or a stale record. How do you suggest handling subdomains delegated to a third party that needs a different CA, without weakening the apex policy?