[brianpan]

If you use certs, then you also get Certificate revocation lists. You don't just trust the CA, you also trust the CA's CRL.

https://en.wikipedia.org/wiki/Certificate_revocation_list