The time window can be reduced to zero by always issuing the new key together with the certificate that revokes the old one .
This requires co-location of authority to both revoke keys and generate new keys .
The time window can be reduced to zero by always issuing the new key together with the certificate that revokes the old one , but this requires co-location of authority to both revoke keys and generate new keys .