There is so much on TLS beyond Let's Encrypt. For instance, TLS allows user certificates to authenticate the user, not the server. This works a bit like SSH pas

There is so much on TLS beyond Let's Encrypt. For instance, TLS allows user certificates to authenticate the user, not the server. This works a bit like SSH passwordless login (thanks to key authentication). This technique only works if the site operator also controls a CA which the browser accepts. Companies can easily install self-signed certs to do so, but on the wild web that's quite difficult. So yeah, even today there are use cases for custom CAs.