It's only needed by large, highly regulated businesses, and it only works for self-hosting obviously.
Is that obvious? Using AWS you delegate access to KMS keys to other accounts.
Slack doesn't provide a self-hosting option at any tier. This allows you to host the encryption key in your own AWS account's KMS service, which Slack then (running in Slack's own AWS account) then queries.