I am guessing smtp would be the most obvious choice here? checking certs issued by someone else against a CRL you dont necessarily control ?