Hacker News Reader

Sign a certificate expiring in 2070 and delete the CA key. That's all management you need. And if anyone has access to your disk, it's much easier for them to add you their CA certificate than search for your CA key.

That may be so, but I from the perspective of a few billion people using Chrome, the percentage of people that need to and should access something on the local network without encryption is probably a few magnitudes smaller than the same audience on Hacker News.

This doesn't make sense unless you use the CA for something in addition / more critical for HTTP.

Sure, you could leak said CA, but it's only going to leave you in the same position as HTTP.

You can generate CA certs that are only allowed to sign certs for specific domains, but _nothing_ respects that self limitation.

That means that if the CA keys get out, someone could use it to sign their own cert for google.com, [mybank].com, or [mypasswordmanager].com. Every device with my CA cert on it will trust those.

That's a fair point.