I mostly agree with you, but the PKI backend in Vault will let you import certificates to use(specifically an Intermediate). That's what we did, we have an inte

I mostly agree with you, but the PKI backend in Vault will let you import certificates to use(specifically an Intermediate). That's what we did, we have an internal CA, and the vault PKI backend has 1 intermediate certificate signed by the CA that it controls, so we can use the vault PKI backend and create certs on demand using vault, but keep the "One True Authority" CA (outside of Vault). As for #3 and #4, you can write tooling around vault using the generic backend to store the data to accomplish both of those things.