More on upki:

https://discourse.ubuntu.com/t/an-update-on-upki/77063

My interest in building OneCRL support into upki has definitely increased this week. Issue:

https://github.com/rustls/upki/issues/229

I'm hoping some organizations will step forward to fund work on this.

(Note that curl on Ubuntu 26.10 now has CRLite support baked via upki -- unfortunately that doesn't help with this because AIUI CRLite is only for end entities, not for intermediate certificates.)