Should the revocation list credential issuer match the verifiable credential issuer?

[kdenhartog]

Our team was looking into the code and noticed that there's no check to make sure the revocationListCredential issuer matches the verifiable credential issuer. This creates the potential for the revocation list to be issued by a separate party which in the case where the server hosting the revocation list is compromised, it would allow for the adversary to create their own DID and to change the status of the credential to revoked or un-revoke it as well.

Should this check be added or was it intentionally left out?