For a large enough organization, this could be enough. Would it be possible for a hacker to break in, extract the private key, cover their tracks, then create, say, a phishing website that uses the Barracuda CA? Would it show up as a self-signed certificate at any other organization, but it would show up as a trusted site within the organization?