[Feature Request / General Approach] OCSP for non-downstream sockets

Our OpenResty installation is configured to create a TCP co-socket to upstream servers and making HTTP requests using lua-resty-http.
When calling the co-socket SSL handshake I noticed the 4th parameter is send_status_req which requests OCSP stapling during the handshake.

1. I didn't see any code validating the response. And indeed I setup a small setup of an OCSP server and an invalid certificate - and nothing happened. Am I doing something wrong? Is there any functionality to this feature at the moment?
2. We would like to have the ability to validate OCSP in case there's no stapling in the response (the upstream server didn't support / want to hand a response). Currently the only way I'm aware of receiving the SSL certificate chain out of the SSL handshake will be to parse the user data with an FFI call to OpenSSL. After having the chain I'd be able to use the very helpful ngx.ocsp to issue the requests with my own strategy. Is this something we'd want to have implemented within the engine (and have configuration to choose the strategy)? I believe at least exposing the SSL handshake certificate chain will be useful to begin with :)

What do you think?

Start by tracing the co-socket SSL handshake, including its send_status_req parameter, and review the existing ngx.ocsp functionality and the proposed OpenSSL FFI certificate-chain access. Done would require a decided scope for validating stapled responses, handling missing stapling, and exposing the certificate chain or configuration strategy.