If you mean signed by your CA then this is me too, albeit with an intermediate CA in the middle (honestly pointless in my case, but old habits etc).

I don’t host anything externally and trusting the CA certs internally is easy as Ionly need to do it on a handful of devices. This + reverse proxy keeps things tidy and uncomplicated.

It might be a jumper on the board. Mine (Q770G4) boots on power, if I can organise some downtime with the family I’ll take a look at it (set it up ages ago so can’t remember).

Edit: CAB approval was easier than I expected! Mine is in the BIOS, under Chipset > PCH-IO Configuration, set State After G3 to Power On.