First of all, thanks for the reply. I wasn't trying to imply that Chrome/Firefox we're wrong in not checking. I understand your points against it; I'm just sayi

First of all, thanks for the reply. I wasn't trying to imply that Chrome/Firefox we're wrong in not checking. I understand your points against it; I'm just saying that if people revoke their old certificates today (because they might've been compromised) someone can still MITM pretend to be any of those websites if they actually got the key. Lower scope but still a problem, especially if your cert lasts for 3+ years. I was using crlset-tools to test the list against an intermediate Comodo CA and the intermediate/anchor certs for Versign and it didn't return any results. I did the same thing for DigiCert and it did return some, so I assumed what I was doing was correct.