As far as I understood the installed certificate still has to be signed by a root certificate? So wouldn't it also be valid if served by any other party? Why studies need access to internal apis is a good question, i had studies enabled and the only ones i saw switched a setting...