Hi Jeff,
regarding your question:
Can I assume that X509Crl's with an identical IssuerDN and a newer ThisUpdate replaces an older X509Crl with the same IssuerDN?
you need to check the "Delta CRL Indicator" of a CRL to see whether you have a delta CRL or a complete CRL. RFC 5280 (http://www.ietf.org/rfc/rfc5280.txt), section 5.2.4., gives you more information on this.
Regards, Torsten
