OCSP-must-staple. Solves the revocation problems in web PKI?
casecurity.org