You could ignore the validity of the TLS certificate when checking OCSP. That way, passive listeners are foiled, and only active MITM would be able to see which certificates you're checking. It's better than HTTP plaintext, which is how it works now.
Most of the bulk surveillance, pattern-of-life IC stuff is passive, not active.
Ultimately, though, I should be able to opt out of app/binary signing (and associated certificate checking) entirely if I so desire, ideally with a preference setting, or at least with Little Snitch. It looks like I'm going to have to compromise platform security overall to disable it, or use external network filtering hardware.
Additionally, it seems excessive to check every time. Checking once a day would be enough (if it needs to be global and immediate, Apple could push a kill hash to Gatekeeper as I understand it). The volume of queries would greatly exceed the size of getting the updates to the CRL every day (or hour!). Indeed, OCSP stapling is a cache of the signed proof of validity.
It also seems like a bloom filter could be used instead.
It really points to Apple being quietly satisfied to have this massive stream of usage data. And available every ISP and snooper along the way too.
Most of the bulk surveillance, pattern-of-life IC stuff is passive, not active.
Ultimately, though, I should be able to opt out of app/binary signing (and associated certificate checking) entirely if I so desire, ideally with a preference setting, or at least with Little Snitch. It looks like I'm going to have to compromise platform security overall to disable it, or use external network filtering hardware.