We're not at that point yet, but running your own trust root is getting quite annoying. For example, Android constantly nags about "network might be monitored" when custom certificates are installed.
It won't if you add name constraints to your root certificate (because then it can't be used for blanket monitoring).
This is why I baked my home network certificate into the system trust store when building the ROM.
But for beginners there are some pretty nice LineageOs build guides floating around:
For specific pieces of hardware: https://wiki.lineageos.org/build_guides.html
Generic instructions: https://forum.xda-developers.com/chef-central/android/how-to...
As far as changing the certs, I know offhand to do it with a couple random linux distro's but i'm not 100% sure for android, you might just try searching the repo for the default certs then looking at how they are built into the image and tweaking that.