func VerifyRevocationInfo(revocationInfo RevocationInfo, signature *pkcs7.PKCS7) (bool, error) {
	foundOcsp := len(revocationInfo.Ocsps) > 0
	if foundOcsp {
		ocsp := revocationInfo.Ocsps[0]
		err := VerifyOcsp(ocsp)
		if err != nil {
			return false, err
		}
	} else {
		log.Println("there is no ocsp to validate")
	}
	foundCrl := len(revocationInfo.Ocsps) > 0
	if foundCrl {
		crl := revocationInfo.Crls[0]
		err := VerifyCrl(crl, signature)
		if err != nil {
			return false, err
		}
	} else {
		log.Println("there is no crl to validate against")
	}
	if !foundCrl && !foundOcsp {
		return false, nil
	}
	return true, nil
}
VerifyRevocationInfo checks:
- that the status of the ocsp response is GOOD
- that the signing certificate is not revoked according to the crl
package pdf_sign
import (
	"bytes"
	"crypto"
	"crypto/x509"
	"crypto/x509/pkix"
	"encoding/asn1"
	"errors"
	"io/ioutil"
	"log"
	"time"
	"github.com/philhug/go-trustlists/pkg/trustlists"
	"go.mozilla.org/pkcs7"
	"golang.org/x/crypto/ocsp"
)
func VerifyPkcs7(p7 *pkcs7.PKCS7, signingTime time.Time, content []byte, validationInfo RevocationInfo, trustedAnchors *x509.CertPool) (bool, error) {
	signers := p7.Signers
	if len(signers) != 1 {
		return false, errors.New("signature must have exactly one signer")
	}
	signerInfo := signers[0]
	authAttrs := signerInfo.AuthenticatedAttributes
	var digest []byte
	for _, authAttr := range authAttrs {
		var OIDAttributeMessageDigest = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 9, 4}
		if authAttr.Type.Equal(OIDAttributeMessageDigest) {
			_, err := asn1.Unmarshal(authAttr.Value.Bytes, &digest)
			if err != nil {
				return false, err
			}
			log.Printf("verify: extracted digest from pkcs7")
		}
	}  
	if len(digest) == 0 {
		return false, errors.New("message digest not found among authenticated attributes")
	}
	hashp, err := getDigestAlgorithmFromOid(signerInfo.DigestAlgorithm.Algorithm)
	if err != nil {
		return false, err
	}
	hash := *hashp
	h := hash.New()
	h.Write(content)
	computed := h.Sum(make([]byte, 0))
	if bytes.Compare(computed, digest) == 0 {
		log.Println("verify: computed hash == digest on pkcs7")
	} else {
		log.Println("ERROR: Computed != Digest")
		log.Println("Expected: ", digest)
		log.Println("Computed: ", computed)
		return false, errors.New("computed digest does not match expected digest")
	}
	signerCertificate := p7.GetOnlySigner()
	if signingTime.Before(signerCertificate.NotBefore) || signingTime.After(signerCertificate.NotAfter) {
		return false, errors.New("signer certificate was not valid as for the timestamped signing time")
	}
	log.Println("verify: the signing certificate was valid as for the timestamped signing time")
	intermediates, err := getIntermediates(p7, validationInfo)
	if err != nil {
		return false, nil
	}
	verifyOptions := x509.VerifyOptions{
		Roots:         trustedAnchors,
		Intermediates: intermediates,
		KeyUsages:     []x509.ExtKeyUsage{x509.ExtKeyUsageAny},
		CurrentTime:   signingTime,
	}
	_, err = signerCertificate.Verify(verifyOptions)
	if err != nil {
		return false, err
	}
	log.Printf("verify: signer certificate verification was succesfull")
	return true, nil
}