I agree that HP was careless here but IMO Apple should learn here that developers who ask for a cert revocation may not understand the consequences or the cases

I agree that HP was careless here but IMO Apple should learn here that developers who ask for a cert revocation may not understand the consequences or the cases where this is necessary. I have no idea what the cert revocation workflow looks like, but providing cases where it should and shouldn't be used would be useful. It's still certainly possible that this falls squarely on HP and there's only so much you can do when someone is determined to blow their foot off.