The customers for certs are technical people capable of seeing past that, so let them change it every day if they want.

No, the customers for commercial certs are mid-level managers, who believe paying thousands of dollars for something you can also get for free means you are getting a higher quality - or in this case even believe it is "more secure". Rebranding will absolutely work for that, especially when you market your untrusted root as "ISO-certified private dedicated cloud-based PKI-as-a-Service".

The technical people will just install a certbot and use the default Let's Encrypt config.