Can't remove a certificate from the revocation lists until it's expired, leading to boundless growth of those lists. Risk of private keys/certificates from old

Can't remove a certificate from the revocation lists until it's expired, leading to boundless growth of those lists. Risk of private keys/certificates from old backup media being leaked (remembering the adobe password leak...) and then suddenly coming back online and working until someone figures out how to revoke them