Unable to verify OCSP response

[jsha]

@kerio

I believe it's done on purpose, to reduce the size of the OCSP responses and to avoid having to build a whole new trust chain on the client.

That is correct. And the OCSP Signing key usage is only required for dedicated OCSP signing certs. Signing OCSP directly from the issuer doesn't require additional extensions.