Comment by Eridrus

I feel like my takeaway here is that things that are not connecting software written by a wide group of people should not rely on the root CAs.

We often use TLS to connect software run by the same organization because it is convenient, but why are we giving random CAs the ability to issue certs for these cases?