Based on a conversation in [this HN thread](https://news.ycombinator.com/item?id=40401695), it's probably worth considering how to support certificate revocation.