zlacker

For more explanations check: http://qubes-os.org/FAQ.html and the architecture document. Reasoning is there.

Regarding OCSP (Online Certificate Status Protocol) - have a look at http://en.wikipedia.org/wiki/Moxie_Marlinspike#OCSP_Attacks