Comment by paranoidrobot

Adding CAs to trust stores on devices and in apps is a major pain.

If you have unmanaged devices this becomes even more painful.

"Oh, hi, welcome to the company, please install this Root CA onto your machine to access <internal service>"

Because you can't scope CAs to specific domains, this causes everyone with any idea about security to start being concerned.