Several things in DownloadProtectionService can take many seconds, and
the user only sees that there's 0-time left on the download. Show some kind of UI.  If we can show progress, that's even better.

Source of delays:

* Checking certs
* Unpacking/inspecting DMGs and ZIPs (10% of DMGs exceed 10 seconds)
* Calling out to Google (usually < 100ms)