We don't know /a priori/ whether the user will, as 99%+ of zones on us do, reverse proxy traffic through us. The vast majority do, and thus your statement of "y

We don't know /a priori/ whether the user will, as 99%+ of zones on us do, reverse proxy traffic through us. The vast majority do, and thus your statement of "you have no intention of using" is wrong; we intend to use this certificate, and almost always do. The reason that a certificate is issued on zone activation is that issuance takes non-zero time. And the second a user decides to route traffic through us, we need to have a certificate in place terminating TLS otherwise the user will experience downtime due to their visitors not being able to connect via HTTPS.