[wejn]

"only" out of scope.

But based on the comments here, I guess you could use the smallstep CA with Nitrokey HSM if that's your jam...

[e12e]

Well, the title says: "Running one's own root Certificate Authority in 2023".

"Running a CA" is pretty much dominated by managing certificates? Including distribution and revocation - not just issuing?