[iancarroll]

> Revoke certificates for old compromised versions of an installer so that downgrade attacks are not possible.

Worth noting that Windows accepts signatures from revoked code signing certificates so long as it has a signed timestamped before the revocation.

[hamandcheese]

….and I assume the revocation can’t be back-dated?

[ComputerGuru]

timestamps must come from a globally recognized signed source, like digicert or verisign.

[iancarroll]

The CA could backdate the CRL’s revocation timestamp if they wanted, but it seems unlikely and presumably it’s not allowed.