It does check for revocation. Using the developer's unique certificate ID, which, for the vast majority of developers, uniquely identifies an app. Over unencrypted HTTP.

OCSP over unencrypted http has not yet been replaced. I believe that the constellation of apps (identified by proxy by their developer IDs which are transmitted) can in a lot of cases uniquely identify a system, given a sufficient number of apps installed/used.