Implement a client-side blacklist for authority certificate signing keys
For background see https://lists.torproject.org/pipermail/tor-dev/2014-April/006663.html and https://lists.torproject.org/pipermail/tor-dev/2014-April/006664.html .
We should have a way to blacklist authority signing keys at the client-side. In the longer term, we should implement a full on revocation (see #11458 (moved)), but for now, we can at least revoke certificates hard by blacklisting them client-side.
I think that the right way to do this is to have any signing keys on that blacklist always have their signatures treated as "BAD". This doesn't prevent us from fetching or holding those certs, and so doesn't mess up our cert fetching code.
Obviously, any fix here is a backport candidate.
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information