It&#x27;s an interesting question whether it would be a good idea to require revocations to be signed <i>by the subject key</i> rather than by the issuer key. I guess it depends on the threat model!<p>Conceptually, the idea is that if the issuer makes an assertion about what&#x27;s true, they want to later be able to stop making that assertion. That seems to make basic sense. (But in some threat models, the issuer might have been coerced, and maybe it&#x27;s easier to coerce authorities to revoke than to misissue. For one thing, browsers are unlikely to kick CAs out of their trust lists for improper revocation, but they might for misissuance!)