Ever-growing CRL?

The browser vendors consume the various CRLs and produce their preferred data, since they own it they get to make the rules, which is beneficial to them and, arguably their users. Suppose a CA says we don't consider that what we did was mis-issuance for 8000 certs, so, we're just not marking them revoked. The vendor can say too bad, we're marking them revoked immediately anyway. Which is a smaller stick than "Since you were uncooperative we're distrusting you"

As with the Web PKI itself, there's a trade off to be made about what you hope to get out versus available resources to do the work. Consuming OneCRL means now you're stuck with Mozilla's choices on everything, but you need only barely enough volunteer effort to write and maintain the OneCRL consumption code, nothing more. A hypothetical GNOME-CRL built the same way would be able to do whatever GNOME wants, regardless of Mozilla, but incurs a considerable maintenance overhead forever.

The biggest thing I expect that a OneCRL is handling is bugs. My guess is that over a year probably half a dozen cases arise where oops, this CA turned off the machine that makes a CRL and so now it's just a 404 or a timeout, or doh, that other CA accidentally uploaded their CRL to the wrong URL every single day for the last six weeks, somebody fat-fingered the destination filename, fetch some-ca.example/CRM.dat instead of CRL.dat. Building a pipeline that's robust against the first sort of nonsense yet flexible enough to cope when the second sort happens will make these worth their time.

As to OCSP stapling, my understanding is that the HTTPS server software is just garbage - especially Apache - and this software has mostly rusted in place, so if you're in the browser client business you can't expect anything which requires the server software to be properly engineered to ever work, you have to base your assumptions on it's garbage, it will never be fixed and nobody who could do anything about that is interested in doing so. It's very much a case of if you don't Do It Yourself (as things like OneCRL do) then it won't get done. This is not a problem for the top 1% sites, your Facebooks, Youtubes, Wordle - somebody is getting paid to keep those working, and they probably read documentation and apply patches _they_ could have OCSP stapling (but many do not). But 99% of sites aren't like that, maybe they were thrown together by somebody's nephew six years ago and live "in the cloud" on a web server which is never maintained and will be gradually rusting until they're taken over by crooks or turned off. They're never getting OCSP-stapling.