It also makes bit flip errors a lot more obvious, which is another way of saying harder to ignore, so that can go either way.
Lots of banking apps don't work.
RCS has only just started working.
No "Find My Device" support.
Permissions model is difficult to understand - even I struggle with it.
Standard launcher has tiny icons which can't be adjusted.
Pop on to https://discuss.grapheneos.org/ and see the struggles which users have.
I don't have any issues with it
Then I learned about Docker.
That said I only have a couple of TBs...bit more and HDDs do become unavoidable
Why not 60 seconds? That's way more secure. Everything is automated after all, so why risk compromised certificate for such a long period, like 45 days?
Or how about we issue a new certificate per request? That should remove most of the risks.