There’s a lot of criticism of Google CRLSets, and some of it is valid, but there’s no defense for CRLs and OCSP as they currently work.