[Dylan16807]

Revocation doesn't work well, so we're simplifying and relying on expiration for that. So no to the super long certs.