Not answering the concert regarding CT (I concur).

But the obvious answer for truly secure connections is your own CA root or a self-signed cert you manually install/enforce.

You don't want to pass through another CA if your service is private. You actually don't need to. In fact, you'd want to manually enforce a single root or distrust system certificates entirely when doing so to avoid the problem you describe.

Most decently-written software that supports SSL/TLS allows you do that.

The CA system is for services that you intend to make public.