Do it for cheap?<p>It’d be extremely expensive if every university would have to pay for a full CA root certificate.<p>Instead, just having a self-signed one, limited to their own domains and subdomains allows them to use eduroam, or provide their own signed software, or sign certificates for people who want to provide their own software, etc.<p>Safer, simpler, and cheaper. (Although some unis actually have a CA certificate limited to *.uniname.tld)