I agree with the issues around OCSP and soft-fail, but I don't think shipping a subset CRL list of 'important' revocations is ideal, either. I've just re-keyed

I agree with the issues around OCSP and soft-fail, but I don't think shipping a subset CRL list of 'important' revocations is ideal, either. I've just re-keyed certificates I'm responsible for as a precaution after patching for Heartbleed. For one of the certificate providers used, GoDaddy, re-keying automatically revokes the old certificate, which is exactly what's wanted in this case. But would that be considered an 'important' revocation? I have no way to be sure, but I'm assuming not -- as this is the same mechanism used by GoDaddy for routine rekeying. Perhaps this is simply a problem with GoDaddy's certificate management tools, but I'm uncomfortable with two tiers of revocation, one of which is a "real" revocation and one of which is ignored by browsers.