During a chat today someone mentioned that they run a DBus daemon as root because it needs access to a root owned certificate. This made me realise that we should advocate "LoadCredentials=" more and move folks to DynamicUser.
https://systemd.io/CREDENTIALS/
#systemd