PKI works nicely under its presumptions, but a public ledger (like CT where TLS certificates are logged to) is a useful enhancement to it. That way you can actually verify things instead of just trusting the CA.