Deep dive on Windows revocation providers and trust validation, for when CRL/OCSP's good enough is apparently not.