Yes indeed, and you can do just that. The API server is open-source[1], and it's been Dockerized. Anyone who's really paranoid should absolutely run the server themselves.
Edit: what if this were built into Firefox? Could the certificate manager accommodate some UI improvements and an export feature?
As for self-hosting, I think anyone who wants to deploy mkcert in anger should self-host, and I believe I've made it trivial to do that. There are some steps I can still take to improve this: I want to pin Mozilla's cert in the client so that it can't be MITM'd, for example.