microsoft/msquic#3318 introduced new API for validating peer certificates asynchronously:

• Value of QUIC_STATUS_PENDING is returned when handling PEER_CERTIFICATE_RECEIVED event
• Later, use ConnectionCertificateValidationComplete to set the result.

We would have to dispatch a Task to threadpool to do the actual validation, so this may slow down the handshake a bit (affecting time to first byte in HTTP/3), but might improve overall effectiveness as we don't block MsQuic threads while we download CRL or intermediate certificates for the actual chain building.