Embed Notice

@Jerry What I'm asking is if the revocations are verifiable client-side (this would require the full signature from the revoking party) or if you have to trust that the site you're downloading them from verified them.

In the latter case, the threat of that site being forced to report a false revokation for a site a state authority wants to shut down is orders of magnitude worse than the threat of continuing to trust a compromised cert for some site (where the risk of further damage is basically zero, because the damage was already done when the attacker compromised the site and got all the data they held on me).