OcspResponderRevocationPolicy

Revocation policy for delegated OCSP responder certificates (RFC 6960 §4.2.2.2.1).

• 'honor-nocheck' (default): a responder carrying id-pkix-ocsp-nocheck is exempt from revocation checking. Otherwise, CRL evidence from ValidateOcspResponseInput.responderRevocationCrls is consulted when provided — a revoked responder rejects the response; missing or unusable evidence is tolerated (soft).
• 'require-evidence': nocheck is ignored; CRL evidence must positively show the responder is not revoked, otherwise the response is rejected.
• 'skip': no responder revocation checking.

type OcspResponderRevocationPolicy = honor-nocheck | require-evidence | skip