There is actually now a dormant but a powerful system that's a win-win to privacy and CA's infra bills: OCSP stapling (and the associated must-staple directive)

There is actually now a dormant but a powerful system that's a win-win to privacy and CA's infra bills: OCSP stapling (and the associated must-staple directive). Instead of the client requesting OCSP validation directly, the web server does that on behalf of its visitors. This saves on CAs since that the web server can minimise the request to every minute (or even every half-hour if that's what the website operator desires) and is definitely a win for privacy (as users will no longer be required to send a request to the CAs). The only probable downside is that revocations aren't instant, but in theory you could arrange your CA to issue 5-minute validity OCSP responses allowing for faster revocation. Now if this exists, why aren't people switching to this? Google. Chrome doesn't even actively validate revocation information anymore, and Android didn't even bothered to do many of the required validation since practically its inception (so much that Let's Encrypt exploited that fact to allow their CA to still issue valid certificates to older Android devices: https://letsencrypt.org/2020/12/21/extending-android-compatibility.html https://letsencrypt.org/2020/12/21/extending-android-compati...). Since Google insists that revocation is broken (as demonstrated though it can be fixed now if we want to) no-one (at least at a corporate level) is seriously pushing OCSP must-staple. P.S. you should at least read GRC's post about CRLSets (the only mechanism available in Chrome) that was posted in 2014 a few days after the Heartbleed discovery (https://www.grc.com/revocation/crlsets.htm https://www.grc.com/revocation/crlsets.htm). It's still (unfortunately) relevant today, amd says a lot about Google's security practices.