Thanks for the list, I went though it. Some items I feel need to have some warnings. For example, disabling OCSP: yes, it improves the privacy, but it reduces

Thanks for the list, I went though it. Some items I feel need to have some warnings. For example, disabling OCSP: yes, it improves the privacy, but it reduces security, that should be made clear. Also, OCSP stapling is the fix the privacy issue of OCSP, hence disabling it does not make sense here. But since „only do OCSP if OCSP stapling is supported“ does not exist as far as I can tell, it does not really matter. That would actually be the correct setting, preserving privacy while ensuring that revocation checks still happen.