[_qulr]

The notarization check is on first launch of an app, but it doesn't occur on subsequent launches, unlike the certificate revocation check.

[tgv]

But the first lookup would have to stay, with all the implications that the proposed alternative (download a list of all certs/tickets) was meant to overcome.