[minusf]

i think because what is asked for is a list of revoked certs, and the connection being used could be already on that blacklist. the list must available without the involvement of what is being checked.

[charcircuit]

That's not what OCSP is. OCSP just lets you query the status of a cert.