Does Sema Validate Certificate Chains or Only CT Log Inclusion?

Clarifying Sema’s Validation Scope

Sema ingests Certificate Transparency (CT) logs and indexes DNS names from certificates for domain queries. The tool verifies log signatures and Merkle consistency, but it is unclear whether it performs full X.509 path validation against a trust store.

Unresolved Design Decision

The repository documentation notes that Sema does not check revocation status, expiration, or CA trustworthiness. However, it does not explicitly state that it omits chain validation. If Sema were to incorporate a trust store (e.g., Mozilla’s root list), would the API return only certificates that chain to trusted roots, or would it keep the current behavior of listing all CT‑logged certificates regardless of trust?

Key Questions

• Does Sema currently perform X.509 chain validation against any trust store when querying by domain?
• If Sema were extended to filter by trusted roots, how would that affect existing query results and API contracts?
• What would be the impact on performance and storage if revocation checks (OCSP/CRL) were added to Sema’s validation pipeline?