It's sensible to require waiting for a certificate check the first time an app is launched, but after that, the cache validity should be indefinite, and updates should occur asynchronously in batches.

The timeout settings were also excessive.

Can't forget the blatant lack of encryption. They either forgot or thought it would be too much effort to set up.