From what I read [here](http://arstechnica.com/security/2013/12/french-agency-caught-minting-ssl-certificates-impersonating-google/), if the intermediate CA has been compromised, a fake cert can be issued and the privacy of the end-users could be compromised as well. In order to remediate this situation, someone have to report this and have this cert be revoked by the CA that issue the intermediate cert.

At the end of the article, it suggested CT (Certificate Transparency). I understand that CT's "auditor" will constantly query the "monitor" and "log server" to check for the validity of the cert. On the other hand, "monitor" will query the log server as well. However, one thing I'm not clear is that, how's CT going to help us if no one reported that the cert or CA has been compromised?

Also if it depends on others to verify the CA and cert can we think CT as a type of P2P CRL/OCSP?