There are companies that run ACME internally so all their internal resources are secure. They can then push the company CA via group policies, or make them avai

There are companies that run ACME internally so all their internal resources are secure. They can then push the company CA via group policies, or make them available for Linux devs to install. But you're right about trying to run another public LetsEncrypt style CA. Getting your root cert signed and into browsers is a major undertaking and I'm really glad we have LetsEncrypt. We might be tied to one big provider, but everything they've done is open if other people want to attempt it.