30

The same reason any company's IT department operates as their own certificate authority. Or, at least they should. Why do they do this? Because it's more secure.

Now, I use Joplin Cloud. I live with the fact that my data, though encrypted, and traveling over an encrypted network, is more exposed. I make a judgement on how exposed I think I am and what data I can risk. Adding MFA to the process is certainly a better step forward regardless.

Is being your own CA a nightmare? No. But it's not for casual folks to tackle, as I mentioned in my comment. It's not rocket science, but it's also not trivial.

The same holds true for managing ssh login permissions, root access, what IPs even have any ability to connect, etc.

I.e. if you self-host a server that hosts data, either the data needs to be non-sensitive or you need to be serious about securing and maintaining that server properly. Or both.

I know how to properly lock down a server, but I still use Joplin Cloud and make appropriate compromises. I'm glad MFA was added.