I’d like to be able to limit certain privately imported root certificates to specific domains — that would be a valuable feature in a browser to protect against

I’d like to be able to limit certain privately imported root certificates to specific domains — that would be a valuable feature in a browser to protect against corporate hijacking. However for the average person what you propose is meaningless.