Revocation

The key server's revocation store -- importing CRLs, reading the evidence, looking up a certificate, and the per-issuer revocation policy.

Operation	Auth	Purpose
POST /api/revocation/crls	Bearer + DPoP	Import one or more DER CRLs into the key server's revocation store.
GET /api/revocation/evidence	Bearer + DPoP	List every CRL the key server holds as revocation evidence.
POST /api/revocation/lookup	Bearer + DPoP	Ask the key server what its revocation store says about one certificate.
PUT /api/revocation/issuers/{digest}/policy	Bearer + DPoP	Set the revocation policy for ONE issuing CA.
DELETE /api/revocation/issuers/{digest}/policy	Bearer + DPoP	Remove ONE issuing CA's revocation policy.