Software Supply Chain
Certificate Revocation
Also: CRL, OneCRL, CRLSet
Telling clients to stop trusting a certificate before its expiry date, because its key was exposed or it was issued wrongly.
In more detail
Browsers receive revocation lists in the background, so a bad intermediate can be blocked within hours. Many other clients, such as programs written in Go and tools using a bundled CA list, do not check revocation at all and only change when their code or bundle is updated.