Hi Frank,
[...]
 
  I have to admit that if it is not the
proxy-settings then I am getting somewhat desperate about how to diagnose the problem.
 I guess one could try to get stack traces from the server while it is starting up
 and use the java option "-Djavax.net.debug=all" (dumps lots of stuff to the
standard output) to see if it tries to open connections to 
extensions.xwiki.org
 but I guess all one can get from that is that the server opens connections and then it
waits till timeout ... 
 I've done this through setting the environment variable $JAVA_OPTS to
 "-Djavax.net.debug=all" prior to running $tomcat_home/bin/catalina.sh.
 Is that the right place?  I also set the following loggin levels in
 $tomcat_home/conf/logging.properties:
 java.util.logging.ConsoleHandler.level = FINEST
 1catalina.org.apache.juli.AsyncFileHandler.level = FINEST 
 
 Also added
 java.util.logging.ConsoleHandler.level = ALL
 java.util.logging.ConsoleHandler.formatter = org.apache.juli.OneLineFormatter
 org.apache.http.level = FINEST
 org.apache.http.wire.level = SEVERE
 to $tomcat_home/conf/logging.properties (according to
https://hc.apache.org/httpcomponents-client-ga/logging.html) but still not seeing the wire
output.  where should I find it?
  
 [...]
I thought one should set the -Djavax.net.debug in the CATALINA_OPTS ,  but I see JAVA_OPTS
is possible, too.
If these lots of "adding as trusted cert:" messages appear, then the option is
active indeed.
If you want to create more log messages from the xwiki-webapp, you can edit the file
webapps/xwiki/WEB-INF/classes/logback.xml
Setting the root logger level there to "debug" will create tons of output ...
Maybe it is sufficient to enable some network related loggers, like:
  <logger name="org.apache.http" level="trace" />
  <logger name="org.eclipse.aether" level="trace" />
which will create tons of output either, but hopefully with somewhat higher relevance
density.
See also 
http://platform.xwiki.org/xwiki/bin/view/AdminGuide/Logging
hope this helps
Clemens