Having worked in IT, I assure you this is not a 99% implemented solution.

Weird internal setups, dozens of proprietary or in-house sites, different verification needs for internal vs. external.

And I'm speaking of the easier scenario of an internal CA.