Yes, 400K is a lot of revocations, but we can only download the CRLs and treat them as gospel. Keeping a low false positive rate is important because, in the e

Yes, 400K is a lot of revocations, but we can only download the CRLs and treat them as gospel. Keeping a low false positive rate is important because, in the event of a hit in the filter, the resulting OCSP check has to be hard-fail and, if that starts bringing down good sites, then that's a problem. In the end, we have to collect data and see how it does in the real world. The theory suggests that it might work but reality always has tricks.