Certificate Transparency solves the rogue CA scenario for domain owners.
The static CT API does have a "names tiles" API but it's not a real/usable thing.
On top of that, to monitor you have to download full certificates and parse them all. Does that seem like a great way to do this to you?
I wasn't aware of that, I know of a few teams that do this internally and seemingly have no problems, I'll ask them next time I get a chance. Thanks for your answer.