That's the thing I don't understand about this whole discussion: The SafeBrowsing blacklist bloom filter that Google itself made and uses is significantly small

That's the thing I don't understand about this whole discussion: The SafeBrowsing blacklist bloom filter that Google itself made and uses is significantly smaller, is updated in real time, and doesn't have a big runtime overhead. Why not just have a bloom filter for revocations, with a Google server doing the false-positive elimination? (Yes, there is a little bit of a chicken-and-egg problem when it comes to the Google server, but that's a much smaller problem than being unable to check if most certificates in the world are revoked or not.) Edit: Looks like Adam (of course) already considered this: https://www.imperialviolet.org/2011/04/29/filters.html https://www.imperialviolet.org/2011/04/29/filters.html