3 ms·

They could also keep the current solution and just use a CRL as a backup to OCSP to check the revoked certificates and update it every other hour...