bug: paykit refuses tls connections after most cold launches #1425

What happened?

After most cold launches while signed in to a Pubky profile, Paykit refuses every TLS connection for the rest of the session. Logcat shows KeyStoreException: BKS not found, then NoClassDefFoundError for CertificateVerifier on every later Paykit call, until the app restarts. Measured on master: 9 of 10 online cold launches on an emulator.

Expected behavior

Paykit connections work after every cold launch.

Steps to Reproduce

1. Sign in to a Pubky profile.
2. Cold-launch the app while online, several times.
3. Watch logcat for BKS not found or the CertificateVerifier error.

Reproducibility

9 of 10 cold launches on an Android emulator.