You eventually have to roll over keys at least once every N years, so if you are automating it, the length of time doesn't really matter.
In this case, they are just limiting the window.
In this case, they are just limiting the window.
Meanwhile I really am paranoid about long-lived keys of any sort, especially if they need to be online as TLS keys must. I wish CAs offered short-lived keys more readily (and web infrastructure supported it); I'd love to enable them for all Sandstorm properties.