Selecting a group makes the trustlet reload every template in it from storage,
and on this device that is 651276 bytes crossing the listener in chunks. Measured
over ten verifications: eleven claims, eleven reloads, fifty-four chunk reads,
twenty-six megabytes of round trips. All of it happens before the verify loop
starts, so all of it lands in the latency a user feels while being invisible to
the daemon's own timing -- which is how it survived this long.
It is also unnecessary. The trustlet holds templates in memory once loaded; a
successful authentication on stock produces no storage callbacks at all. A group
that is already active does not need selecting again, so a repeat claim now
answers from what the last real selection reported.
Enrolment forces a real selection, because it adds a template and the reload is
the point.
Measured after: two claims, one real selection, one skipped, and the chunk reads
drop from five per claim to two for the pair.
Jorijn van der Graaf
231a1860ac