> Why can't this be purely client-validated like passport chips? From the diagram this looks similar. The client-server is to fetch the certs and revocations,

> Why can't this be purely client-validated like passport chips? From the diagram this looks similar. The client-server is to fetch the certs and revocations, and handle the signing infrastructure.