> The simple solution is a local certificate authority which is added to the users’ browsers. It can deliver certificates automatically or manually.

I wish it was possible to add a certificate authority and restrict its usage to non-Internet servers (e.g. *.company.example).

(This is theoretically possible if the CA bakes that in, though not all TLS stacks support that. It isn't possible via local browser configuration.)