Implement badge revocation using the W3C Bitstring Status List in an Open Badges 3.0 issuer

Steps

1. At issuance, assign each credential a unique integer index within a status list bitstring of at least 131,072 bits (16 KB uncompressed); embed a credentialStatus object of type BitstringStatusListEntry referencing the status list VC URL and the assigned index
2. Publish the BitstringStatusListCredential at a stable HTTPS URL; the credential contains a base64url-encoded, GZIP-compressed bitstring where bit position 0 means not-revoked and 1 means revoked
3. To revoke a credential, set the bit at its assigned index to 1 in the bitstring, recompress, re-encode, re-sign the status list VC, and republish it at the same URL
4. Implement a caching strategy for the status list with appropriate Cache-Control headers; verifiers may cache it per the HTTP directives, so revocation propagation is not instant
5. During verification, fetch the status list VC, decode and decompress the bitstring, check the bit at the credential's statusListIndex, and treat a value of 1 as revoked regardless of a valid cryptographic proof