(5) already issued for this exact set of domains in the last 168 hours

Typing with my thumbs here, so forgive not providing references, but root store requirements [0] don't make a distinction in OCSP lifetime between revoked and valid OCSP responses, so there's no advantage for HSM signature processing time.

[0] pkipolicy/policy.md at master · mozilla/pkipolicy · GitHub

4 Likes