Got it, that was the main missing link that I was looking for. Devices are frequently phoning home to get an updated certificate revocation list.