Awesome, good luck, We had vault deployed(but unused) for a few months while trying to figure out how to use the vault PKI backend to secure vault itself. We finally gave up, and did the external CA solution, with vault holding an intermediate. We actually have 2 intermediate keys, 1 that vault uses, and 1 that long running services (like vault) use for their TLS keys.

We used this https://jamielinux.com/docs/openssl-certificate-authority as a guide to get that all going. Good luck! otherwise awesome write up. I wish we could share more of what we do internally, but it's complicated.. getting permission! :)