<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<br>
<blockquote type="cite"
cite="mid:0100018279bcc11a-7fccae90-6400-4fbe-bc3b-6012d1dbe107-000000@email.amazonses.com">
<p class="MsoNormal">However he also noted the possible privacy
concerns that some may have regarding OCSP being used to mine
information about users opening encrypted emails. Corey Bonnell
pointed out that the same privacy issues could befall CRL as
well in the case of sharded CRLs.<o:p></o:p></p>
</blockquote>
<p><br>
</p>
<blockquote type="cite"
cite="mid:0100018279bcc11a-7fccae90-6400-4fbe-bc3b-6012d1dbe107-000000@email.amazonses.com">
<p class="MsoNormal">Stefan Selbitschka noted the privacy issues
relating to revocation are equally a concern that should be
placed upon the mail user agents. Stephen noted that he would
adopt some of the improvements however found in Martijn’s PR.</p>
</blockquote>
<p>Wouldn't this be a moment to consider creating (or agreeing to
create in the future) something like S/MIME OCSP-stapling?
Alternatively, the rules could forbid the use of a OCSP responder
for tracking purposes? Because a general lack of revocation
information to avoid potential privacy concerns sounds like a
tradeoff that's too expensive.</p>
</body>
</html>