That should worry the hell out of you. If you could install CAs only for a certain domain (default to the name constraints but actually set in the browser/Os)

That should worry the hell out of you. If you could install CAs only for a certain domain (default to the name constraints but actually set in the browser/Os) that would be fine, but installing a CA gives anyone with access to that CA the ability to make pretty much any valid cert, and your potential lack of security raises flags