What kind of zero-day does this protect against that wouldn't be blocked by an at-launch-time update check like most regular software uses? If anything, at-launch-time is better because Keystone's last update check might have been 2 hours before the 0day patch came out, but at-launch-time would check immediately and notice.