nebula-mesh revokes a host by adding its certificate fingerprint to a per-CA blocklist and shipping that list to every other agent on each poll. Slack's Nebula enforces certificate revocation ONLY through the "pki.blocklist" list in "config.yml" (no CRL/OCSP). The project's own code states this: "internal/pki/durations.go:15" — "Revocation via the blocklist remains the immediate security control." The server side is fully implemented (computes per-CA blocklist via "GetBlocklistForCA", returns it in the agent-updates response, sets "has_updates=true" when non-empty). The agent side was never implemented: 1. The agent decodes the "blocklist" JSON field into "UpdatesResponse.Blocklist" ("internal/agent/poller.go:33") and then DISCARDS it — "poll()" applies "CertificatePEM", "CACertPEM", "ConfigYAML", but never references "updates.Blocklist" ("internal/agent/poller.go:300-339"). 2. The config generator has NO field to emit "pki.blocklist" — "pkiSection" is only "ca"/"cert"/"key" ("internal/configgen/marshal.go:42-46") and "GeneratorInput" carries no blocklist ("internal/configgen/generator.go:23-52"). So even the server-rendered "config.yml" shipped via "ConfigYAML" cannot carry it. Result: a blocked/offboarded/compromised host's certificate is never rejected by its peers. Its handshakes keep succeeding for the full remaining cert lifetime — up to 30 days for agent hosts ("DefaultAgentCertDuration") and 365 days for mobile hosts ("DefaultMobileCertDuration"). Blocking a host in the UI/API has no effect on the data plane.