Hmm, I considered this possibility in a comment, incidentally two hours before yours, below. Let the CA have an ability to revoke certs, I'm not suggesting against that. I'm suggesting a method in addition to it.