> You don't need short expirations for that. CRLs/OCSP already provided a mechanism for certificates to be revoked before they expire. But that's an explicit a

> You don't need short expirations for that. CRLs/OCSP already provided a mechanism for certificates to be revoked before they expire. But that's an explicit action that's much simpler to ask questions about.