This is just phase 1 in my learning.
Phase 2 - which may not be immediate - will be about running my own CA capable of responding to ACME requests from certbot and similar.
@nprofile1q... is part III where you attempt to persuade browser providers to put your CA in their root bundle?
1