Additionally, it seems excessive to check every time. Checking once a day would be enough (if it needs to be global and immediate, Apple could push a kill hash

Additionally, it seems excessive to check every time. Checking once a day would be enough (if it needs to be global and immediate, Apple could push a kill hash to Gatekeeper as I understand it). The volume of queries would greatly exceed the size of getting the updates to the CRL every day (or hour!). Indeed, OCSP stapling is a cache of the signed proof of validity. It also seems like a bloom filter could be used instead. It really points to Apple being quietly satisfied to have this massive stream of usage data. And available every ISP and snooper along the way too.