I believe these instructions give you a CA root that can sign certificates for the entire web (a man-in-the-middle CA). I'd be hard pressed to trust such a CA i

I believe these instructions give you a CA root that can sign certificates for the entire web (a man-in-the-middle CA). I'd be hard pressed to trust such a CA if it was created by anyone other than myself (or my employer, for work owned devices). Best practice is to use name constraints to prevent the trust root from impersonating, for example, google.com if your LAN only uses .corp or similar.