Do we support any kind of key revocation ?  If the key is ever compromised, can I tell the system to stop trusting it ?  If we do any kind of signature-checking, do we support checking for subsequent revocation of the signing keys (CAs can get compromised, too) ?