If a worker starts up and tries to connect to a controller before the controller has a chance for its rotate roots job to run, it'll spit out a nasty-looking error. It's harmless (things just retry and then work) but scary (`tls: internal error`). Rotating at creation time ensures that it's ready by the time a worker is able to perform any connection against the cluster port.