Some devices could have no battery (or bad battery). Such that time/clock is not preserved when devices lose power. The bad time will be fixed by tlsdated. However, there is a race between the time fix and kiosk crx download. Kiosk crx download is done via https. If time is not fixed before it starts. The https would fail with an invalid certificate due to wrong time.

We should retry the download after the time is fixed. Or just retry a few times after some timeout.