I'm flexible about this, depending on what the community wants.
It would complicate CRL processing, becuase some entries might
be pending and thus would require that one make subsequent
passes or be able to mark cache entries with future revocation
times.
I think we should follow X.509. If a certificate is on the CRL then it is
revoked. If it is not on the CRL, then it is not revoked. This approach is
simple, and I prefer simple. Until we have fielded X.500 drectories, the
distribution of CRLs will be complicated enough...
Russ