Most of the IDP types, except for htpasswd which we don't permit anyway have an attribute that specifies the CA that signs the certificate of the IDP. However, there is no way of knowing if the certificate was revoked, because there doesn't seem to be a way to set an OCSP or CRL to check for certificate validity. This needs to be researched and perhaps an RFE should be filed.