Stuart Henderson wrote:

> What's the benefit? I do see a downside to changing this.

It's more for correctness than anything. I don't see a use case
where the builtin ikectl CA would issue intermediate certificates
and issue end-entity certificates at the same level.

For complex two-tier PKI you are installing your own certs into
iked and not using the builtin CA.