Public Key Infrastructure: An Artifact...

Lynn.Wheeler at firstdata.com writes:
> The other solution is to go online and do real-time checks ... but
> doing real-time checks invalidates basic design decision trade-offs
> associated with choosing a R/O partial replicated distributed data
> implementation in the first place.

Have you looked at the design of SPKI CRLs?  I think there are
possibilities in there that address the difficulties you raise.
--
  __
\/ o\ paul at cluefactory.org.uk
/\__/ http://www.cluefactory.org.uk/paul/