That was with a CA certificate, though. AFAIK, as long as the certificate marked as trusted does not have the CA flag set, and isn’t a wildcard cert for “*” or

That was with a CA certificate, though. AFAIK, as long as the certificate marked as trusted does not have the CA flag set, and isn’t a wildcard cert for “*” or something silly like that, it can only be used to impersonate the specific domain(s) named in the certificate. Thus, even if the certificate is in the system global trust cache, it wouldn’t allow anyone to “MITM any connection that doesn't have some kind of key pinning”, only connections to that site. However, I can’t rule out that trusting a certificate for “localhost” for which an attacker knows the private key could still cause some sort of security vulnerability, though I’m not sure what exactly it would be.