There is an important difference between (A) trusting "just this one" cert for a specific reason, and (B) installing a root cert that is able to impersonate any

There is an important difference between (A) trusting "just this one" cert for a specific reason, and (B) installing a root cert that is able to impersonate any server. It ought to be a practical to do (A) without doing (B), but due to a variety of deep human and technical problems, it isn't.