My earlier post was unclear - I've always added CAs, but had not used a CRL (either in current e3200 tomato/shibby OVPN setup, or AC86u testing) until I tried to replicate your test.
Will try and replicate using Chicago .ovpn; and will also disconnect my other active PIA link (dont think it's...