WebPKI (the term for certificates used for web browser as opposed to the general usage of certificates outside of the web) requires that all certificates now be included in a public, widely used certificate transparency log. That fact gets included in the certificate delivered to your browser. Your browser will reject any certificate* that was not included in a certificate transparency log.

Take your instance discuss.tchncs.de for example, we can see all the certificates here. If you looked at that list, do you see anything wrong? Probably not.

But you're on to something. A malicious certificate is minted and it's in the CT log, so what? I don't check the CT log every time I go to a new webpage. Instead, CT logs are more able giving information to security organizations and companies to detect violations under their own properties. A company like amazon or google would setup CT log monitors to continually monitor for certificates issued for their domains. If they detect one, and they didn't request it, they can flag it to the cert authority board and it can get CAs pulled from the root trust stores. I can (and probably should find time to) setup certspotter on my own domains.