curl -- OCSP verification bypass with TLS session reuse

Hiroki Kurosawa reports:

    curl inadvertently kept the SSL session ID for connections
    in its cache even when the verify status (OCSP stapling)
    test failed. A subsequent transfer to the same hostname
    could then succeed if the session ID cache was still
    fresh, which then skipped the verify status check.