OCSP

nginx quietly skips OCSP stapling until a resolver appears in scope

The dangerous nginx bugs are the ones that emit no runtime signal at all, so the only artefact carrying the evidence is the config text itself. Stapling with no resolver in scope is the cleanest case of the class.