As far as I understand, this is done for every application installed. Every time. And it seems that the certificates are not unlimited and they will have to be renewed.
GraphenOS is supported only by Pixel. So we're waiting for a port to other devices! Although I think it's impossible, since only Pixel has a security chip.
VLC
7-Zip
Steam
FireFox
Everything else deteriorates beyond recognition over time.