How certificate revocation (doesn’t) work in practice

I just tried to submit the same thing. This seems particularly relevant to how difficult it's going to be for the Internet to recover from the heartbleed bug [1] currently being discussed everywhere on HN.

[1] http://heartbleed.com/