Steve,
Well, the X.509 spec for CRLs says that they represent
certificates which HAVE been revoked, not ones which will be revoked
at some future time. One might quibble over the wording, but I think
the intent was clear. I admit that hot listing an employee entry
based on an agreed to termination date (for example) is convenient.
I'm flexible about this, depending on what the community
wants. It would complicate CRL processing, becuase some entries might
be pending and thus would require that one make subsequent passes or
be able to mark cache entries with future revocation times.
What do other folks think?
Steve