> In a company with controlled workstations, have your own CA and push the trust of that through GP or in your standard OS build
I'd be surprised if this did not cost when done properly. Securing a (even internal) CA is a whole thing that is not trivial.
If you are already maintaining a CA for any other reasons then use that or the same process to maintain another, otherwise the second option is probably the path of least extra work/cost.
> In a company with controlled workstations, have your own CA and push the trust of that through GP or in your standard OS build
I'd be surprised if this did not cost when done properly. Securing a (even internal) CA is a whole thing that is not trivial.