I wonder if its worth collecting stats on how long this takes; it takes almost a sec on my mac. 

It might also be worth logging somehow how many certs we have; there's a munin monitor for the opscode-certificate service. Not sure what the lightest weight way of doing that is.