"Only" missing how to safely distribute, trust and revoke/renew the root cert - and how to enforce/distribute revocation lists for certs...
But based on the comments here, I guess you could use the smallstep CA with Nitrokey HSM if that's your jam...
"Running a CA" is pretty much dominated by managing certificates? Including distribution and revocation - not just issuing?