But if an attacker has a private key that is trusted by your local trust store, they can pose a legitimate website (man in the middle) and decrypt your traffic.
The title tells me that this thread is about local https. Nothing to do with prod.
I thought there were varying amounts of trust with certificate stores?
Local dev certs should go into a personal store or something that is less trusted than something like VeriSign. You shouldn't be able to mint a legit-looking Google certificates with the same private key that's only trusted via a local self-signed certificate.
But if an attacker has a private key that is trusted by your local trust store, they can pose a legitimate website (man in the middle) and decrypt your traffic.
The title tells me that this thread is about local https. Nothing to do with prod.