[otterlicious]

Android constantly nags about "network might be monitored" when custom certificates are installed.

It won't if you add name constraints to your root certificate (because then it can't be used for blanket monitoring).

[bostik]

Does this actually work now? A name-constrained CA (or even its CSR) used to break things in absolutely hilarious ways.