revoked so that the CRL generation will add them to the CRL. They will be pruned by the nightly dbcheck.