Validation would not be fully on the critical path. The individual pairings could all be calculated in the mempool. Only the pairing on the aggregate signature e(g, sigma) (where sigma is the aggregate sig) and any pairing e(pk_i, H(m_i)), where i corresponds to a "message/tx and pubkey pair" that has not yet been seen would need to be calculated on the critical path. Pairings on transactions already seen can be precalculated. If all transactions in a block have been previously seen, then only 1 pairing need be calculated for validation: e(g, sigma), which itself uses a fixed-point and can be sped up significantly. This value would then be compared to the product of all pairings  e(pk_i, H(m_i)), which have been precalculated.

Therefore, the total best-case validation time would be the time to compute e(g, sigma) and the product of n pre-calculated pairings.

Awesome! Great tool. Would be interesting to look at some of the hacked exchange transactions with this.