Surely you know this ‘telemetry’ statement isn’t really true. They use badly designed open protocol to do certificate revocation. It’s not like they designed this as a way to collect user data.

Perhaps they don't intend to use the data as telemetry, but regardless, intentionally or not, they are receiving information about what you are running, even if it were just a hash of the binary. So you're right, it would be a trivially small information leak, but I'd like to think a company focused on privacy wouldn't resort to such an aggressive protocol.

I haven't followed this very closely, has anyone determined exactly what is being sent?