> Is /etc/certs not used by most graphical Mac software, I guess?

Correct, those usually use Apple's networking APIs which all go through their security stack, which already picked up the OCSP revocation within about 2 hours in most cases.