[cpach]

You can guard the root certificate better than the leaf certificate. For example, you can keep it offline in an air-gapped environment.