If you're that much of a target, you'll find your devices hacked soon enough regardless.

I can't speak about your threat model, but "exfiltrating my private CA keys to phish my browser" isn't really something I worry about in practice.

For those still checking certificate validity, Firefox will warn you that the certificate used is not in the system database when you click the little lock in the address bar.

That said, I'd absolutely love a system where I could restrict my private CA to certain domains.