[nhoughto]

minor additional benefit is that it configures 'service account signing' in k3s OOTB, so you don't have to hack it in by changing config behind docker desktop's back if you really need it like we did.