It’s probably just easier to use public certs with DNS verification than building and distributing your own certs.