> What has been puzzling me ever since is that these OCSP checks have been well-known for a couple of years, This is where you’re wrong. It was known, but not

> What has been puzzling me ever since is that these OCSP checks have been well-known for a couple of years, This is where you’re wrong. It was known, but not well-known. Users do not expect an HTTP request to be blocking their application executions. Personally, I don’t see why CRL is not sufficient. Yes I want malicious signatures blacklisted, but can’t I just get a list instead? Some of the reasons CRL is no longer used do not apply to code signatures.