Honest frame: goca does not serve OCSP responses today. The current build is CRL-first — the ocsp role is a listener shell, and there is no presigner, response cache, or responder handler behind it. If your relying parties require OCSP, goca is not yet the CA for that population, and no amount of configuration changes it.
good/revoked answers through keysvc intents, and pushes verified cache generations to database-free responder replicas. The public responder would perform no CA-key operation at all. Same philosophy as CRLs: validation infrastructure holds artifacts, never keys.What you do have is the stronger default for most estates: full CRLs, signed on schedule and on revocation, served by database-free distribution replicas with honest freshness reporting. Size your CRL validity against your relying parties' cache behavior and revocation is covered — just say "CRL-first, OCSP on the roadmap" out loud when someone asks, because your auditors will.
Now I can answer "do you support OCSP?" without hedging.