Just want simple TLS for your .internal network?

tbh the skill level require for a valid wildcard cert isn’t all that high either.

This is about creating and using a domain-restricted CA, which is then used to create server certificates. Point being that your (tech savvy) friends are willing to install the CA because it can only ever validate some specific subdomains (and not MITM the entire internet).