There appears to be a corner-case where hackage-security's sync logic doesn't recover automatically during a mirror-fallback-scenario when there's an outtage when the cache-folder is missing certain files (because e.g. a previous bootstrapping attempt was aborted prematurely). One example I was able to observe is when there's only a root.json file.