This isn't uniquely a Chrome CRLSet problem: OCSP & CRLs in general are also defective. None of them are capable of rapidly and reliably warning TLS clients, wh

This isn't uniquely a Chrome CRLSet problem: OCSP & CRLs in general are also defective. None of them are capable of rapidly and reliably warning TLS clients, when those clients are still trusting certificates that the original site, CA, and browser vendor have all announced are compromised. But we're almost 20 years into the SSL/TLS/CA era. A broadcast/alert system that's resistant to all but the most draconian of regimes is possible. (It should also be self-evident when you're cut off from current data.) P2P networks provide usable ideas.