I have one question regarding the OCSP protocol to check if the certificate is revoked or not. The question is about checking whether the intermediate CA certificate immediately below the root CA is valid or not. I know that when we send an OCSP request to validate a certificate, the corresponding response must be signed with the private key of the issuer of the certificate we are checking. So in this case it must be the root CA's private key. Also, I know that the private key of the root CA (and the whole root CA) is offline, so it will not be signed with that key, but with the private key of the authority that the root CA has delegated to be the OCSP responder (the root CA will create a certificate for this delegated authority and will sign it). So my question is:
If the response is signed with the delegated authority's private key, how can the client verify that the response is valid or not when the client does not have the delegated authority's certificate (so it does not have its public key)? The client only has the certificate (and public key) of the root CA, so how will it get the certificate (and public key) of the delegated authority to confirm the response?