As you hint, measuring down to fF is not trivial. Measuring Cps is effectively a common mode measurement. After quite a bit of shoddy experimentation, I found that applying between 10MHz and 100MHz common mode was the way to do it. You don't get a sensible result <10MHz because your signal is too small. I used the 'scope in FFT mode (and externally triggered) in order to get a nice narrow bandwidth at the frequency of interest and reject noise/interference in my measurement. A spectrum analyser with tracking generator would be even better. The interesting thing (well, I think it's interesting) is that up to 100MHz Cps is a very good model of the common mode coupling between primary and secondary of a transformer. But you do need to do measure at many frequencies in order to put a line through the results and ignore all the peaks and dips due to RF misterminations and reflections. I shorted primary and I shorted the secondary. I applied the RF via a through termination between chassis and shorted primary. I used 300MHz oscilloscope to measure between shorted secondary and chassis, with cable terminated at oscilloscope (oscilloscope is reasonably flat up to 100MHz, so that's what set my 100MHz limit). I folded a pair of aluminium right angles and bolted them over the transformer so that they (just about) touched to form a box with open ends. I fitted an input BNC on one side of the transformer, connected to the shorted primary by as short a wire as possible. I did the same on the opposite (secondary) side. The folded aluminium was quite long and overhung the transformer by about 70mm. But there was still a big hole at each end, so I folded some thick aluminium foil over each end and taped it down with self-adhesive copper tape. I taped copper tape over every gap. I learned about copper tape going through EMC compliance testing. That dealt with the practical side of the measurement. Generator was Agilent E4420B and oscilloscope was Tektronix MSO54
I plotted received voltage against frequency on a graph. Also on the graph, I plotted the expected signal from a capacitor feeding a 50R load. I adjusted capacitor value until model and measurement overlaid. (Well, "overlaid" is perhaps an exaggeration, but I told the Excel Solver to twiddle C for a least squares fit.) To get the uncertainty, I calculated standard error of the fit between model and measurement.
As for getting an 8fF transformer, that was a lot of work. The Topaz transformers individually screen their primary and secondary with copper foil, but that's not good enough for a safety barrier, so they also add a sheet metal screen between primary and secondary. That would become a shorted turn, so they use a pair of earthed sheet metal fingers coming from either side, but with the fingers insulated to avoid a shorted turn. It's effectively a third screen (albeit not terribly effective). To make my 8fF transformer, I didn't have a coil winder at the time, so although I was happy to hand wind a secondary on its bobbin (on a stick) and count turns, I wasn't happy to do a primary. So I improved the finger screen. I found that tiny little gaps were enough to increase coupling between primary and secondary, so I kept adding copper tape everywhere I could see daylight looking from one side to the other. I had to add a lot of insulating shims to ensure that I didn't form a shorted turn between finger screens and stampings. I can't show you a photograph because after all that work, the transformer had to do something useful, so it was put in a die-cast aluminium box with a folded aluminium screen over it and copper tape over gaps to prevent incoming mains being coupled to the output. I'm afraid an LM317 regulator was then used - my aim was to squash common-mode. However, my technique of improving the finger screen was a poor way of attacking the problem. The way to do it is to do what Topaz did and individually screen primary and secondary. Now that I have a coil winder with turns counter, I could do that. But what stops me are the safety issues. In modifying a transformer kit that already had reinforced insulation between primary and secondary, my modifications didn't add any safety issues. But winding a primary, insulating it, and screening it very definitely does. So that's why I'm suggesting that you only screen the secondary and can expect to achieve < 0.1pF, but even at that capacitance, you need very careful screening of the mains wiring.
I'll dig around to find the 8fF spreadsheet results graph and post it later. Found it! The "Thing" transformer was a commercially made 50VA transformer with foil E/S screen. You can see I was able to get reliable measurements down to quite a low frequency with 2pF of capacitance. With the "Copper foil wonder", 8fF made reliable measurements a lot harder, and they only appear > 10MHz. Note all the peaks and dips for both sets of measurements due to RF misterminations. It's Version 3 because it took me three attempts refining my measurement and construction before I got a good result.
On the foil round each winding, when I came back to the start, I put a turn of polyester tape over the copper so that I could overlap the foil without shorting. But I then put another turn of polyester tape over that overlap and covered it with more copper tape to create a radio frequency maze. Otherwise, RF would have leaked through the thickness of the polyester tape that prevented the shorted turn. Yes, I know polyester tape is thin, but I repeatedly failed EMC compliance due to an unregarded 0.1mm gap. Once spotted, a little copper tape allowed a pass, so I now know to be very careful about gaps. If (using a powerful torch) you can see light, you have a gap and it needs copper tape - it's as simple as that.
I didn't test the Topaz and I should have done. Why not? Because I needed to use it and I'd already added an MOV across the input, and 4n7 Y capacitors from the end of each winding to shell. But from the measurements I've made I see no reason to doubt their claim - initially surprising though it is!