Certificates make the most sense to me. The delay can possibly be due to cached certificates, having to find the person to sign the CSR (assuming in-house PKI or even just someone with access to the right email address for external PKI), and/or a CA that isn’t valid on the machines.