Couldn't this be enforced at the router? Intercept outbound TLS. If the client hello is to a new domain, hold it and start a new outbound connection and see if the server responds with a certificate on the CRL. If so, ban it. Otherwise let the original TLS connection proceed.
replyThat would work with TLS 1.2, but not TLS 1.3. TLS 1.3 sends the certificate after the session key is derived and symmetric encryption is established.
reply