Having talked with PKI folks at the first three of those, no: there is considerable weight at Google and Apple at least that non-public certificates do NOT belo

Having talked with PKI folks at the first three of those, no: there is considerable weight at Google and Apple at least that non-public certificates do NOT belong in the public PKI. There’s reasonable evidence to be had that many of the problems public CAs have had with content and algorithm agility has stemmed from the use of public CA infrastructure for internal or private uses that never belonged in the public space. Things like OU fields, custom OIDs, and old algorithms were all difficult to move away from because large customers of public CAs were busy using those things for purposes better suited for internal infrastructure. This is one reason many of the browsers have started enforcing things like CT stamps for roots with clear exceptions for enterprise CAs. They want to encourage people to move their internal uses to internal PKIs instead, so that it’s easier to make clear rules about the content of public certs.