This should be improving now, we discovered a few sources of slowness. Our Vault store is under heavy load and we’re working to scale it.
We also issue both RSA and ECDSA certificates for hostnames – many ECDSA certificates were behind, and we found that apps with only RSA certs would check vault for ECDSA certificates before handshaking. This is now fixed, once a cert is cached and fast we don’t wait on any vault lookups before the handshake happens.