Since OCSP fails open and response stapling is still only deployed on a minority of servers, it doesn’t provide much of a guarantee…