You're assuming that the ocsp process looks at /etc/hosts. I would not be surprised if it did it's own DNS lookup to a hardcoded DNS nameserver for the ocsp.app

You're assuming that the ocsp process looks at /etc/hosts. I would not be surprised if it did it's own DNS lookup to a hardcoded DNS nameserver for the ocsp.apple.com lookup.