With its PKI endpoint, it makes it pretty easy to stand up an internal CA. No faffing about with arcane openssl commands.

The 3 of 5 keys thing is just a default and easily changed.