Yes, the main reason it was created is OpenStack deployments where Anchor is used for securing internal communications, so the PKI is an internal one (most likely).

We cannot change how the CAs work in public networks unfortunately, but if they do, we're going to be ready :)