revocation and crl operations are OK - verify need to take CRL in account (see #3)