We did this as well. To mitigate the danger of a vault outage, we had a very tightly restricted endpoint which generated 24 hour certs that were fetched by auto

We did this as well. To mitigate the danger of a vault outage, we had a very tightly restricted endpoint which generated 24 hour certs that were fetched by automation on a single box. In the event of a vault outage, we'd have a day to either fix it or deploy public key access.