OCSP is indeed broken in many ways. On the bright side, with the ca/browser forum limiting the max length of a certificate to about a year it would be pretty e

OCSP is indeed broken in many ways. On the bright side, with the ca/browser forum limiting the max length of a certificate to about a year it would be pretty easy to just use a single revocation list. A CRL 2.0 so to say. Just like the browser downloads the Google safe browsing list. EDIT: Just to be clear; With CRL 2.0 I don't mean blockchain...