Slack does not offer lighthouses or any part of Nebula. They spun off a company, Defined Networks, which is enhancing Nebula, and they offer a hosted CA with k

Slack does not offer lighthouses or any part of Nebula. They spun off a company, Defined Networks, which is enhancing Nebula, and they offer a hosted CA with key rotation and push configuration updates to your fleet, currently in a kind of early beta. You still run your own lighthouses, but they are entirely in control of your CA, so they can sign certs for nodes at their will. That could allow third parties into your networks, but I'm not sure if that would imply any ability to redirect or decrypt traffic.