[ComputerGuru]

timestamps must come from a globally recognized signed source, like digicert or verisign.

[iancarroll]

The CA could backdate the CRL’s revocation timestamp if they wanted, but it seems unlikely and presumably it’s not allowed.