Certificate Transparency + X.509v3 Extension

By @jsha

If we provide SCTs, it would be via OCSP, definitely not by X.509v3 extension.