Perhaps this can just be triggering on the enterprise roots pref, but we should have an option to not apply the filters to certs issued by enrolled CAs for internal enterprise sites if they aren't in CT.

Don't we get this for free because we know exactly which issuers are covered by CRLite?

My thinking about how to implement this has shifted to this: Only use CRLite when at least one "valid" SCT is delivered with the cert. I'm planning to propose a policy that will require CT logging and SCTs delivered with the cert to Firefox. I do think we'll need an enterprise policy that disables the SCT requirement, but I don't think, in this scenario, that we need an enterprise pref to disable CRLite - either we get an SCT and use CRLite, or we don't.

I like Wayne's solution in comment 2. Ship it!