You'd use this if you ran your environments as immutable hosts: you can't add users' public keys to the hosts when they change/join the team, so you let the log

You'd use this if you ran your environments as immutable hosts: you can't add users' public keys to the hosts when they change/join the team, so you let the log into the bastion (which presumably does get updated with new public keys) & let it create the certificate to connect to the target host (and also immediately use it & proxy your connection to it). I think you could compromise on immutability for the SSH CA key file, or else every time you rolled keys you'd have to reprovision your environments.