Only revocations are distributed. Implication is that these lists should be public (error in criteria?), but privacy overrules publication, see §B.2.h See CPS2