>Then there's also the issue of managing certificate revocations.

Revocation updates are in the form of authenticated UEFI variable blobs. They can be applied regardless of OS and don't require a firmware update.