Instead of downloading a whole revocation list, a client (or the server, via stapling) asks the CA about one serial number. I did not run this; as far as I know Go’s standard TLS client does not check revocation by itself.