It might be possible to make tl-ldap-certalias be a bit nicer towards the directories it is querying. LDAP has the fields createTimestamp and modifyTimestamp, which RFC 4512 state that servers SHOULD support. If this is properly supported in practice, we should try to make use of it. Note that this feature probably involves a lot of nasty corner cases as it is essentially a small sync engine. Since these attributes are SHOULD:s and not MUST:s, there must also be possibly to get proper behaviour when the attributes are missing.
Nobody has complained about tl-ldap-certalias being slow or adding too much load to the LDAP server, so let's just close this bug.