Still, I'd suggest issuing certificates for the maximum allowed length, unless requested shorter. Scalable revocation is possible; follow best practices for encryption keys by keeping a separate offline copy of a signed revocation request.
Revocation for X509 certs is a very different matter to that of revoking PGP keys. For X509, the CA can revoke the cert unilaterally, or at the request of the subscriber without the need for the subject private key. In fact, I'm not aware of the existence of a subject-side revocation process that doesn't involve the cooperation of the CA.
