I think the idea is that false positives (cert revoked) result in a call home to Apple for an actual check. The other idea is that because Apple knows all exis

I think the idea is that false positives (cert revoked) result in a call home to Apple for an actual check. The other idea is that because Apple knows all existing certificates, they could conceivably construct filters that have no false positives for those existing certificates... sort of like construction of a perfect hash.