Tell the user to do an update.  This is unconditional for now, but we'll
hopefully fix that within a few months.

Ticket: #6800
Ticket: #7139

If we can't get the CRL, don't treat it is a failure.  The signature
should have been verified what it was downloaded, and this does mean
that if do have to revoke a certificate due to a leak, someone will
get hit by this -- but they would have if they'd downloaded & applied,
rather than waiting.