OCSP validation at moment

First off great set of libraries, they are so much easier to use than pyasn1 and the crypto libs tied directly to OpenSSL.

I understand that according to the documentation the library does not support enabling certificate revocation checks if the moment is set to any value other than now. I feel that at least in the case of OCSP validation this requirement is unnecessary. (based on my possibly incorrect reading of rfc6960 section-3.2)

   5. The time at which the status being indicated is known to be
      correct (thisUpdate) is sufficiently recent;

   6. When available, the time at or before which newer information will
      be available about the status of the certificate (nextUpdate) is
      greater than the current time.

To me those two requirements seem to be related to the time of the OCSP request and not the moment of the certificate validation. As context I'm using your library to validate pkcs#7 SignedData objects that include cross signing timestamp that I am deriving my moment from. I have not looked into the related case of CRL validation.

related code context

ValidationContext allows a moment to be set that is in the past/future, but in doing so the OCSP revocation check is disabled, because the verify_ocsp_response method verifies that moment falls between this_update and next_update

Start with ValidationContext's handling of a non-now moment and validate.py's verify_ocsp_response implementation at the linked lines; read RFC 6960 section 3.2 alongside the existing documentation. Confirm the intended time semantics for OCSP and whether CRL behavior is out of scope, then add focused coverage for historical and future PKCS#7 validation.