Serialize OCSP Redis snapshots with CBOR

ocsp-responder/README.md

@@ -1,6 +1,6 @@
 # KCA OCSP responder
 
-Standalone Rust/Axum responder. It reads one full JSON status snapshot per CA
+Standalone Rust/Axum responder. It reads one full CBOR status snapshot per CA
 from Redis, caches it for one second with a single-flight refresh, and signs
 OCSP responses with a delegated responder certificate.
 
@@ -31,10 +31,11 @@ certificate exists in multiple vaults. The responder validates both this ID and
 the CA certificate fingerprint against every downloaded snapshot.
 
 KCA publishes these keys when `REDIS_URL` is configured. The
-`kca-ocsp-status/v2` JSON contains all certificates issued by that CA, both
-valid and revoked, without a generation timestamp. Freshness is carried by the
-Redis key TTL. The responder never infers status from a partial revoked-only
-list.
+`kca-ocsp-status/v2` payload is encoded with CBOR and contains all certificates
+issued by that CA, both valid and revoked, without a generation timestamp.
+Freshness is carried by the Redis key TTL. The responder never infers status
+from a partial revoked-only list. Publisher and responder upgrades must be
+coordinated because legacy JSON payloads are rejected until republished.
 
 ## Run locally