Yes, X.509 is ....... unfortunate. We'll have to wait and see how the TREZOR team get on with implementing it. TREZOR doesn't have any OS at all at the moment, so an implementation of PKIX will probably end up being larger than their existing codebase. 

That said, X.509 parsing is so security critical that the existing codebases for it are by now pretty robust. Touch wood. So just having a super stripped down OpenSSL implementation is probably good enough.

W.R.T revocation, BIP70 doesn't support this. If your private key leaks you're currently hosed, identity wise, until the certificate expires. This is obviously suboptimal. In a world where we all have infinite time and resources the right fix will be to piggy back on an X.509 extension being proposed in the browser world called "Must Staple". It's a bit in the certificate flags that tell the client to expect a stapled OCSP response and to hard-fail if none is provided. By requesting the CA set this flag when you get your certificate issued, you sign up for more pain but more security.

An OCSP stapling extension to BIP70 would probably not be very hard to implement, but it'd be pointless today because the client has no idea whether to expect it or not. The absence of a certificate changes the UI by showing you a random Bitcoin address instead of a human readable name, but the absence of stapled OCSP would not result in any UI change.

 

I'm hoping that the hardware wallet world just standardises on the TREZOR protocol. It's well designed and these devices all have fairly similar capabilities.