And, moving to a database won't necessarily solve that as a lot of the operational hit happens when the server loads a list of that size and then checks client certificates against it.