We need not trust the messenger to allow revocation. A public broadcast is usually sufficient. Obviously some communication is necessary between the revoker and the verifier but it need not be over a secure channel.

The common way is having CRLs, a revocation is also signed and posted somewhere. And the gatekeeper checks it every time/periodically. A revocation can not be forged.

If the attacker can jam communication he may be able to block. The post or prevent the verifier from seeing it. We could require periodic timestamped lifesigns signing the previous CRL. Thus if we interfere with communication it is detected. However then what? go on lock down? that is an option but opens up possible DOS attacks.

We need not trust the messenger to allow revocation. A public broadcast is usually sufficient. Obviously some communication is necessary between the revoker and the verifier but it need not be over a secure channel.

The common way is having CRLs, a revocation is also signed and posted somewhere. And the gatekeeper checks it every time/periodically. A revocation can not be forged.

If the attacker can jam communication he may be able to block the post or prevent the verifier from seeing it. We could require periodic timestamped lifesigns signing the previous CRL. Thus if we interfere with communication it is detected. However then what? go on lock down? that is an option but opens up possible DOS attacks.

We need not trust the messangers to allow revocation. A public broadcast is usually sufficient. Obviously some communication is necessary between the revoker and the verifier but it need not be over a secure channel.

The common way is having CRLs, a revocation is also signed and posted somewhere. And the gatekeeper checks it every time/periodically. A revocation can not be forged.

If the attacker can jam communication he may be able to block.the post or prevent the verifier from seing it. We couls require periodic timestamped lifesigns signing the previous CRL. Thus if we interfere with communucation it is detected. However then what? go on lock down? that is an option but opens up possible DOS attacks.

We need not trust the messenger to allow revocation. A public broadcast is usually sufficient. Obviously some communication is necessary between the revoker and the verifier but it need not be over a secure channel.

The common way is having CRLs, a revocation is also signed and posted somewhere. And the gatekeeper checks it every time/periodically. A revocation can not be forged.

If the attacker can jam communication he may be able to block. The post or prevent the verifier from seeing it. We could require periodic timestamped lifesigns signing the previous CRL. Thus if we interfere with communication it is detected. However then what? go on lock down? that is an option but opens up possible DOS attacks.