wondering about the case where the file_monitor mtime check doesnt trigger (maybe we could get there before
early if the io is in a thread?). In the gui it doesn't seem like an issue, since we will refresh soonish anyway.

The places force_cert_check get called seem like they expect those files to exist by the time the check runs. (and
at the moment, probably always do since all of the preceding calls will block till they do...). Just trying to figure out
if the cert_sorter api should have a way to "force_sync" in those cases (forcing a "change" signal would do it, though
that potentially would do it redundantly if the signal was already handled. If the force_sync got there first, that would
be okay 

Would it be crazy for productDir/IdDir/entDir to have the file_monitors and for for cert_sorter to connect to the signals
from there? *Directory could raise it's own "cert_changed" (or whatever) if get's changed directly, or if it notices a file
change.