Revoked certs not showing as revoked in browsers

[Nit]

@Nit

without OCSP stapling, which won't be used by an attacker if the private key leaked.

Note (to myself) that this can be fix then support for Must-Staple / TLS-Feature will be deployed to the production boulder (An letsencrypt client option could also be added to ease deployment of this cert extension).