In Section 5.5 we show that only 15% of the malicious certificates we observe are revoked, and the revocation practices outlined in this paragraph are likely a contributing factor for this low number.
 some authors keep using their code signing certificate long after it has been revoked.