OCSP has problems too. Al ot of non-browser applications just don't bother checking revocation. Which is terrible, but there aren't currently any good options.

OCSP has problems too. Al ot of non-browser applications just don't bother checking revocation. Which is terrible, but there aren't currently any good options. The best solution would be making cert lifetimes short enough that you don't need revocation, or making OCSP stapling, or something similar mandatory. But rolling either of those out across the whole internet would be slow and difficult.