It would be useful if we have XG Firewall with heartbeat to an endpoint to use the installed agent to deliver the web browsing CA from the firewall if the option is chosen.
This would allow valid clients to be automatically provided the correct certificates, especially useful in these waning days of AD GPOs as Azure takes over.