YugabyteDB TLS connections accept revoked certificates: no revocation-check option in client drivers

Goal

I need to enforce certificate revocation checking (CRL or OCSP) for TLS connections to a YugabyteDB cluster, covering both client-to-node and ideally inter-node traffic. The drivers expose ca_file, cert_file, and key_file style parameters, but I cannot find any documented flag to enable revocation validation.

Constraints and uncertainty

Public documentation describes revocation support as planned, without a release timeline or configuration details. TLS handling is implemented separately in the Java and Go drivers, so behavior may differ between them. My environment issues short-lived certificates from an internal CA, so a compromised or superseded certificate being silently accepted is a real security concern, not a theoretical one.

Separately, nodes occasionally move to new IPs after restarts, and I am unsure whether driver DNS resolution behavior (TTL handling, caching) interacts with TLS re-validation in a way that changes when certificates are re-checked.

Questions

Is there any supported way in current YugabyteDB releases (assume 2.20+ / 2024.x) to make the Java or Go driver reject a revoked certificate, via CRL or OCSP, or is the only option an external TLS-terminating proxy?

Does the absence of revocation checking also apply to inter-node replication TLS, and is there a documented hardening workaround?

Do the Java and Go drivers differ in DNS TTL handling after node IP changes, and where is that behavior documented?