That was my initial impression, too. However, as far as I understood, there is an API that will just hand out the certificate. I guess they don't want it to b

That was my initial impression, too. However, as far as I understood, there is an API that will just hand out the certificate. I guess they don't want it to be accessed by a web browser because they want us to regenerate and include a newer cert automatically. So you have a somewhat higher setup cost (setup automatic cert update rather than one-time download of your cert), but then you can't forget to update your cert over the years. I believe they also want this is be a fast desaster recovery. So if their main intermediate certficate is compromised, they can revoke it and hand out new certificates (using the backup intermediate cert) for all domains within a very short amount of time. Nevertheless, I would have preferred a good explaination about how to setup this process manually, rather then depending solely on their tool. (In case this process it too cumbersome without their tool, they should simplify it rather than hiding this in their tool.)