Clients could sync a bloom filter of revoked certificates. If the client encounters a certificate that matches the boom filter it would still need to check some

Clients could sync a bloom filter of revoked certificates. If the client encounters a certificate that matches the boom filter it would still need to check some online service to see whether the certificate was revokes or was a false positive. But for most unrevoked certificates the bloom filter would already tell you that it isn't revoked. Another benefit over a pure online service is that when you get a new bloom filter you check all known certificates against it to mark known certificates for rechecking (in case they got revoked since you last visited that page)