[grahamedgecombe]

I don't think `mkcert -install` requires root in all cases. The NSS trust store is stored in ~/.pki/nssdb/ and can be written to without root.

[vectorEQ]

can you create/use a local CA as non-root too?