revocation

Revocation asks every client to check a third party on every connection, and most clients quietly do not. The scored answer explains each mechanism's failure mode and why the industry is moving to short lifetimes.

The response differs sharply between a signing key and an encryption key. The scored answer contains use, rotates, revokes trust, assesses what the attacker could forge or read, and repairs what depended on it.

Trace a withdrawn grant through cached decisions, exchanged tokens and queued work. Define when new actions are denied and account for effects already dispatched.

Signed software outlives the certificate that signed it. The scored answer explains how a timestamp proves the signature was made while the certificate was valid, and how revocation dates interact with it.