My working theory is that the Venn diagram of organizations self-hosting software on an intranet with private DNS and organizations that don't have an internal CA is almost entirely disjoint.

Are the policy concerns you raise related to the above, or something else?