Tendermint version
All, including master

ABCI app (name for built-in, URL for self-written if it's publicly available):
gaiad

Environment:

• OS (e.g. from /etc/os-release): Ubuntu

What happened:
When using an external KMS, GetPubkey() is called a minimum of eight times per block. As the pubkey can reasonably be expected to not change during a given block, this should be cached on the Tendermint side of the connection, rather than pushing packets back and forth over the connection (plus marshalling / unmarshalling overhead - which I appreciate is less now than it previously was). It will also reduce the number of calls to the HSM (where such caching isn't implemented at the KMS) and allow for more concurrent chains to be run on a single HSM before hitting capacity.

What you expected to happen:
GetPubkey gets called once, and once only, per block.

Have you tried the latest version: yes/no
yes

[edit: once per block, rather than once; thanks @melekes ]