Startup
At boot, BGP listener installs received prefixes as unauthenticated
It can use these prefixes immediately, i.e. to get to nameservers etc.
When it has time, it then goes back and does the authentication for all installed prefixes
Incoming routes may be checked when received or in background