Suppose I issue a signing certificate in January, and have a daily CRL issued (expires in 1 day) to verify the validity of that signature.

Then sometime in July I need to revoke that certificate.

My goal is to not invalidate all prior emails signed with that key, but, rather give recipients some assurance that the key was valid and correct when they received the message. CMS/PKCS7 might do what I'm needing IF:

• The sending client includes the revocation response in the message
• The signing PKI infrastructure is correct and not flawed
• The validator will see the SMIME signature, validate it, and also validate the signature as well.

Given the inconsistent support for SMIME (e.g. gmail and all things Google) is there any software or technology that would validate in the way that solves my needs?

Is what I'm looking for viable, or am I using the wrong technology for the wrong purpose?