> You don't need short expirations for that. CRLs/OCSP already provided a mechanism for certificates to be revoked before they expire.

But that's an explicit action that's much simpler to ask questions about.