PnP PowerShell in Azure Functions Article. Where should Certificates be held?

[BaronSparky]

Reading through Using PnP PowerShell in Azure Functions, for app-only/certificate, it directs you to upload the PFX to the "TLS/SSL Settings" for the Function app. This all works really well.

Simple questions...

1. If following this path, is there any added security benefit for a single application/multiple functions, to storing the PFX in an Azure Key Vault store instead?
2. Would it be a load of work/resources for very little/no benefit?
3. Does it make the configuration of the Function app more complicated? or wouldn't it work.

Thanks for any thoughts - This isn't my strong area so really appreciate any thoughts...