What is a certificate revocation list (CRL) and how is it used?