Revocation

Revocation lets an issuer invalidate a credential after it has been issued — when it expires early or the underlying facts change — so verifiers can reject it.

The problem it solves

A credential verifies offline because the signature is self-contained. That is also why revocation is hard: the signature on a withdrawn credential is still perfectly valid.

Status lists

The usual answer is a status list: the issuer publishes a compressed bitmap, and each credential carries an index into it. A verifier fetches the list and checks one bit.

Cheap	One small artefact covers many thousands of credentials
Private	The issuer sees a list fetch, not which credential was checked
Cacheable	Verifiers refresh on their own schedule, not per verification

Expiry as a blunt alternative

Short-lived credentials reduce the need for revocation: a credential that lasts a day is stale before a withdrawal would have propagated. The trade is reissuance frequency against exposure window.