code: func (cert *Certificate) Revoke(tx *sql.Tx, mechanism, reason string, when int64) error {
  	if err := cert.Select(tx); err != nil {
  		return err
  	}
  
  	rev := &Revocation{
  		SKI:       cert.SKI,
  		RevokedAt: when,
  		Mechanism: mechanism,
  		Reason:    reason,
  	}
  
  	// We ignore the inserted value because if it returns false, that means
  	// the certificate has already been revoked.
  	_, err := Ensure(rev, tx)
  	return err
  }
docs: // Revoke marks the certificate as revoked.