> using cert expiration -- I'm ok if the cert was revoked but that's a totally different discussion

CAs can delete certificates from their revocation lists after expiration, which means that you can't tell the difference between a certificate that was never revoked but merely expired and a revoked-and-then-expired certificate.