Interesting Matt,
While that will work, it removes a bunch of the value from Connect’s CA management - the F5 becomes responsible for rotating that cert etc. and won’t automatically have it managed by Consul if it is getting it direct from Vault. We also use very short certs in Connect typically (72 hour lifetime) whereas that is unlikely to be possible.
Have you considered having the F5 still get it’s cert from a Consul agent running on another host? It’s ideal if it uses the same one or small pool as they are cached but that would alow it to not only get a cert but also long poll that agent to see when it needs to rotate if roots change or the cert expires etc.