Exempt revoked intermediate CA certificates from audit updates

[wthayer]

Modify https://www.ccadb.org/policy#5-policies-practices-and-audit-information to clarify that CAs are not expected to keep audit information up-to-date for revoked intermediates.

[WilsonKathleen]

I propose that we make the following change to the CCADB Policy to resolve Issue #30 and Issue #31.

In https://www.ccadb.org/policy#5-policies-practices-and-audit-information

Change "URLs for the following documents are required for each certificate:" to "URLs for the following documents are required for each certificate, unless the exceptions below apply:"

After the list of URLs, add:

Exceptions to providing audit information:

• The SHA-256 fingerprint of the certificate is specifically listed as in scope in the audit statements of the parent certificate, and the "Audits Same as Parent" checkbox is checked; or
• The certificate has expired; or
• The certificate is technically-constrained as described in section 7.1.5 of the CA/Browser Forum Baseline Requirements, or
• The certificate has been revoked, and the corresponding record in the CCADB has been updated with the correct revocation status.