Suppose I issue a signing certificate in January, and have a daily CRL issued (expires in 1 day) to verify the validity of that signature. Then sometime in July I need to revoke that certificate. My goal is to not invalidate all prior emails signed with that key, but, rather give recipients some assurance that the key was valid and correct when they received the message. CMS/PKCS7 might do what I'm needing IF: * The sending client includes the revocation response in the message * The signing PKI infrastructure is correct and not flawed * The validator will see the SMIME signature, validate it, and also validate the signature as well. * Does this whole concept fall apart if when the certificate is expired/superseded and not lost due to theft/loss of integrity of the private key? Given the inconsistent support for SMIME (e.g. gmail and all things Google) is there any software or technology that would validate in the way that solves my needs? Is what I'm looking for viable, or am I using the wrong technology for the wrong purpose?