How are user device OS/app software/antivirus updates handled?

Blacksands requires no client software service to be installed or running at any time.  Blacksands users only require a single 16k Public and Private certificate to be installed within the local OS key store.  The certificate is never updated because the devices OS handles the security posture around all cryptographic functions pertaining to the certificate