Well, the problem is that OSCP is leaking which applications you open (and when you open them) which is the big deal IMO. One solution would be that the OSCP is checking the HTTPs certificate in cleartext once upon startup (and maybe once every day or so thereafter), and is using HTTPs for all subsequent application requests.

I don't really see a problem here how that could cause a loop. This way, an attacker can only see:

- When you boot your Mac because it verifies the HTTPs certificate once.

- When the OSCP daemon makes a clear text request to check that the HTTPs cert is still ok

- That you have just opened an application (but not which application)

IMO that still leaks an unacceptable amount of meta data but it is miles better then using cleartext. Maybe a bloom filter here would be a much better solution + make the daemon regularly fetch bad signature that are not added the the filter yet instead of pulling. Sure the filter may hit false positives sometimes but in that case, the OSCP server could be checked and apple could see if a certificate has a high rate of false positives and adjust the bloom filter accordingly.

Why can't we use a combo of HTTP and HTTPS?