mTLS revocation done right: when CRL is too slow

Client mTLS revocation isn't solved by CRLs or OCSP; both bake in latency that doesn't match how compromised mobile credentials get used. The alternative.