OCSP stapling improves TLS handshake performance and privacy by having the server provide certificate revocation status directly, so clients don't need to query the CA separately.