The linux version of the notifications library we are using doesn't handle the gtk.main loop. It requires the systray to be running to be able to display a notification.
Spliting the start of the systray and the loop we can start the systray pretty early and later on launch the main loop once we have bitmask and other stuff ready.
&
Is not uncommon for the systray to be launched without internet access. For example in the autostart if the network hasn't come up yet.
Let's fetch the vpn cert when the vpn is starting, instead of in the initialization of the standalone bitmask. So if the initialization happens when there is no network the systray doesn't fail to start.