Isn't there something like a certificate revocation mechanism, that basically makes your PC to connect to the CA each time you want to use a cert?