Thank you for the detailed explanation. I was not aware that there were rules enforcing such actions.<p>The linked PDF answers the question why corrupted software stacks do not qualify for forced revocation.  Section 10.2.4 (which is the lever for 13.1.5) requires (but not limited to that) a private key to be &quot;communicated&quot; to restricted parties before a revocation might be considered.<p>--&gt;
For the small fee of some downvotes i learned that any cloud based service storing private keys for end users qualifies for a revocation - as long as the CA knows about it.