I have ran my own CA in various capacities (workplace, private [hobby]). I will say that LE is wayyyy easier than trying to splice in my root certificate to X n

I have ran my own CA in various capacities (workplace, private [hobby]). I will say that LE is wayyyy easier than trying to splice in my root certificate to X number of systems. Also some systems do NOT support custom self-signed root certificates. I acknowledge your points with the risk of intelligence leaking. However most DNS is benign / not a state secret in general.