Guests don't install my CA as they don't need to access my internal services. If I wanted to set up an internal web server that's accessible to both guests and

Guests don't install my CA as they don't need to access my internal services. If I wanted to set up an internal web server that's accessible to both guests and family members I'd use Let's Encrypt for that.