more strictly check that we're failing because revoked
fix crl signing semantics