Revoking certificates is one part, it needs to be done right too:
* Not just 'revoke' and re-issue, you want to make sure you generate a *new* private key, for a new CSR, for a new certificate from a CA.

Also, consider implementing things like, Changing user password on next login, reseting all API keys, etc?