Just in case the stackforge link disappears, the project is being moved right now into OpenStack proper. There's no dependency though, so you can easily use it on its own.
We'll release version 1 soon, so the API will change just a little bit, but the main idea remains: issuing short lived certificates from a single location (or multiple, it works without changes in multi master mode).
If you have any configuration issues, get in touch, we're happy to hear about new use cases for this tool.
There is still the issue of the CA that is in place for anchor - your users have to trust it.
Yes, the main reason it was created is OpenStack deployments where Anchor is used for securing internal communications, so the PKI is an internal one (most likely).
We cannot change how the CAs work in public networks unfortunately, but if they do, we're going to be ready :)
In brief, it attempts to address weaknesses in PKI operations and specifically revocation capabilities by allowing issuance of short-lived certificates based on a set of validation rules. The README has some detail about the tool, http://git.openstack.org/cgit/stackforge/anchor/tree/README.....
A recent presentation is at https://www.youtube.com/watch?v=Q_ZhrQq-_YM.