But, their _starting position_ is that they can't trust the network > “Since the device is not in a state to communicate securely over the network, it cannot o

But, their _starting position_ is that they can't trust the network > “Since the device is not in a state to communicate securely over the network, it cannot obtain time securely over the network as well, unless you choose to ignore network security or at least punch some holes into it by making exceptions.” So, because they can't trust the network, or the time, they instead choose to randomly trust some of the requests over the network. But it's okay because they rely on the certificate from that request to report whether it has been revoked or not.