This doesn't make sense unless you use the CA for something in addition / more critical for HTTP.
Sure, you could leak said CA, but it's only going to leave you in the same position as HTTP.
Sure, you could leak said CA, but it's only going to leave you in the same position as HTTP.
That means that if the CA keys get out, someone could use it to sign their own cert for google.com, [mybank].com, or [mypasswordmanager].com. Every device with my CA cert on it will trust those.