Go 1.27.3 and 1.26.10 ship, x509 distrusts compromised intermediates

The point releases of Go 1.27.3 and 1.26.10 are out, carrying a crypto/x509 change that distrusts a set of compromised intermediate certificates. That matters most on platforms where the system trust store does not get updated for you, so anyone shipping Go binaries to appliances or minimal containers should pull the update rather than wait. Elsewhere, a proposal to add offline UPKI revocation checking to crypto/tls is open for discussion, and an accepted testing proposal will finally surface non-zero exit status in -json output, which should save a few confused afternoons.