Comment by mbac32768

Couldn't this be enforced at the router? Intercept outbound TLS. If the client hello is to a new domain, hold it and start a new outbound connection and see if the server responds with a certificate on the CRL. If so, ban it. Otherwise let the original TLS connection proceed.