Currently blocks are not requested until all headers are received. For example, running a testnet bitcoind now has been running for over 30 minutes and still no blocks have been requested yet (despite 350MB of data having been downloaded for headers from each node).
Not so much an issue as a feature request, but it should be possible to download blocks once some headers have been downloaded (perhaps after checking there's a consensus between more than one connected peer).
We deliberately disabled the downloading of blocks until we have a headers chain with at least nMinChainWork, which is an important DoS protection. It is possible headers sync could be sped up, but it should never be taking 30 minutes unless the peer you're downloading headers from is malicious/astoundingly slow. The "fix" here is to download headers from multiple peers if one is too slow, not download blocks during headers sync.
Could it download a block if it's possible to verify it's an ancestor of one checkpoint?
I think we'd prefer to get rid of checkpoints than introduce new uses for them...a long road, but we're getting there.
Didn't know that.