[goodpoint]

If you still have a device that can log into every system as root what's the security benefit of a CA?

Now you have two critical systems to protect instead of one: the Raspberry Pi and the CA.