> It's a performance optimisation at the expense of security for Chrome users. I'm arguing that the current, soft-fail revocation checking is useless and that

> It's a performance optimisation at the expense of security for Chrome users. I'm arguing that the current, soft-fail revocation checking is useless and that we're not losing anything by switching it off. The actual revocation mechanism at the moment is that a CA highlights a major problem and all browsers push a software update to block it, because nobody trusts the revocation system to work. So an update mechanism that allows us to react faster is a clear improvement on pushing full-browser updates. But, independent of that, the soft-fail checks aren't actually protecting anyone and it's past time that we recognised that and prompted the introduction of schemes that actually can work, i.e. mandatory OCSP stapling or short-lived certs.