I don't know enough about certificate revocation lists (CRLs) to be sure, but isn't it possible for individual browser users to import them? In that case, coul

I don't know enough about certificate revocation lists (CRLs) to be sure, but isn't it possible for individual browser users to import them? In that case, couldn't the EFF or similar organizations take matters into their own hands, and release lists of certificates they think users should be cautious about? I suspect libel laws make this more difficult, but perhaps not impossible, if revocation providers are careful not to overstate their case, but just say "here's a list of certificates of organizations who have been documented to meet the following criteria...". [Edited to add:] http://en.wikipedia.org/wiki/Revocation_list#Publishing_Revocation_Lists http://en.wikipedia.org/wiki/Revocation_list#Publishing_Revo... says that "To prevent spoofing or denial-of-service attacks, CRLs usually carry a digital signature associated with the CA by which they are published. To validate a specific CRL prior to relying on it, the certificate of its corresponding CA is needed, which can usually be found in a public directory." It's not clear whether the browser checks this signature, or whether the user is expected to. In the latter case, a CRL could be signed by the 3rd party revocation provider instead.