Configuring OCSP staple verification in Go's tls.Config

Goal: Ensure that a TLS connection is rejected when the server’s certificate has been revoked, by inspecting OCSP staples present in the handshake using the VerifyConnection callback in crypto/tls.

Constraint: The Go standard library does not automatically validate OCSP staples; applications must add this check themselves, and must decide how to treat connections when a staple is absent, malformed, or the responder is unreachable without introducing unacceptable latency or blocking the handshake goroutine.

• What is the recommended approach to inspect an OCSP staple inside VerifyConnection without performing network lookups that could stall the handshake?
• How should a connection be handled when a valid staple is missing—should it be rejected outright, or allowed under a fail‑open policy with additional logging?
• Is there a pattern to cache or staple verification results across multiple connections to amortize any necessary OCSP responder checks while preserving security guarantees?