I don't see the legitimate use case here. If they're dealing with inbound TLS connections to their cloud services then they can scan or modify the traffic on th

I don't see the legitimate use case here. If they're dealing with inbound TLS connections to their cloud services then they can scan or modify the traffic on the cleartext side of the TLS connection. No need to be a CA. If they have clients on their network they want to MITM then that's not a legitimate use case for a CA at all. It doesn't matter if everything is on their network, it's unacceptable that my browser accepts their signature.