What would make just as much (or more) sense for most of their enterprise deployments would be to let the enterprise's own PKI take over. A lot of businesses would probably want to be able to silently update keys (although I can see the value in pinning/local cache with notification on change). They may do that as part of the "custom LDAP/AD" tier.