revocation: OCSP and/or CRL fetching can be disabled