You can generate CA certs that are only allowed to sign certs for specific domains, but _nothing_ respects that self limitation. That means that if the CA keys

You can generate CA certs that are only allowed to sign certs for specific domains, but _nothing_ respects that self limitation. That means that if the CA keys get out, someone could use it to sign their own cert for google.com, [mybank].com, or [mypasswordmanager].com. Every device with my CA cert on it will trust those.