Lynn.Wheeler@firstdata.com writes:

The other solution is to go online and do real-time checks ... but doing real-time checks invalidates basic design decision trade-offs associated with choosing a R/O partial replicated distributed data implementation in the first place.

Have you looked at the design of SPKI CRLs? I think there are possibilities in there that address the difficulties you raise. -- __ \/ o\ paul@cluefactory.org.uk /\__/ http://www.cluefactory.org.uk/paul/