You need a working internet connection. In most cases you go to the webinterface because you are either setting it up, or something (most likely connection) doesn't work.

That would be a central point of failure and a ton of extra complexity without providing any kind of meaningful security benefit.

What do you mean "without providing any kind of meaningful security benefit"?

It prevents a bored kid who dumps the private key from one router from being able to reliably impersonate thousands of consumers' routers, the world over.

That's a meaningful security benefit.

The attacker would just dump the individual router's key instead and use the remote signer as a signing oracle to impersonate devices.

The owner/operator of the router could do that to their own device, yes.

The idea is that each router would get a certificate signed with a distinct subdomain unique to that router. So you still can't impersonate other devices. It wouldn't be a generic domain or wildcard certificate.

The remote signer would furthermore suspend suspicious connections (i.e. from multiple public IP addresses).