pki-sub-ca: update ocsp considerations