OCSP staping legacy support (#49)

address Rob's comment for [lamps] WGLC for draft-ietf-lamps-rfc5019bis-00
https://mailarchive.ietf.org/arch/msg/spasm/0T34ofAdEnbvryni0kJuVwEPm9U/

draft-ietf-lamps-rfc5019bis.md

@@ -527,6 +527,16 @@ the certificate status request extension mechanism for TLS.
 Further information regarding caching issues can be obtained
 from {{?RFC3143}}.
 
+To provide support to OCSP clients which do not yet
+support the use of SHA-256 for CertID hash calculation, the OCSP
+responder MAY include two SingleResponses in the OCSP basic response.
+The CertID of one of the SingleResponses uses SHA-1 for the hash
+calculation, and the CertID in the other SingleResponse uses SHA-256.
+Once clients reliant on or relevant to a given OCSP responder have
+migrated to the profile as defined in this specification, OCSP
+responders SHALL NOT distribute OCSP responses that contain CertIDs that
+use SHA-1.
+
 # Security Considerations {#sec-cons}
 
 The following considerations apply in addition to the security