Tested with dirmngr 1.0.2 and kontact enterprise35 20081001.865016.

CRL checks use the system dirmngr which has Intevation's Wurzel ZS 3
Certificate in /etc/dirmngr/trusted-certs.

In this initial case, validating a signature made by a certificate
issued indirectly by ZS3 succeeds and is shown in green because the
signature is indeed valid and no certificate has been revoked or has
expired. After this check the CRLs in the cache in
/var/cache/dirmngr/crls.d/ have been updated.

Now, remove the ZS3 certificate from /etc/dirmngr/trusted-certs and
restart the system dirmngr. Repeat the signature check. The signature
still shows up as green even though it shouldn't.

Now, clear the CRL cache by simply removing all files in
/var/cache/dirmngr/crls.d/ and restart the dirmngr. Repeat the
signature check. Now the signature shows up as yellow, as expected.