There is currently no way for a process to be notified (other than polling) of changes to its blessing roots, whilst there is such a mechanism for blessings themselves. See the TestDaemonMode test in x/ref/lib/security which currently polls for changes.