3 ms·

Couldn't that be circumvented by just turning OCSP responses an option available only for must-staple certificates?