What you describe is a "Private CA certificate", and they are used everyday. A "self-signed certificate" is any certificate that does not have the digital signature of a higher certificate authority; the certificate basically tells someone who gets it "I am vouching for myself; you can either trust me or not". SSCs can assert that they are CAs, and so if you trust them, you trust the certificates signed with the CA certificate. The self-signed CA certificate in effect becomes a "private trusted root". Because it lacks global trust, this certificate generally isn't good enough for an anonymous client connecting to your web server over the Internet, but within the boundaries of a network of computers that you fully control, you can tell those computers to trust any certificate you like.
Without a central authority, every machine on the network would require the certificate of every other machine on the network, and implicitly trust all of them. This simple flat "web" trust structure is feasible for a small number of machines like 3-5, but in a network with, say, 100 machines, each machine must have the certificate for the other 99, and the next machine to be added to the network must somehow get its certificate implicitly accepted by all 100 existing machines. The CA structure drastically streamlines this process; all machines implicitly trust one and only one certificate - the CA's - and a CA-signed certificate presented by a new machine will tell all the other computers "the CA trusts me; you should too".
Now, this still requires your CA to be trustworthy; just because it's trusted doesn't necessarily mean it should be. The CA certificate's private key has to be protected against attempts by an attacker to steal it, and should an attacker do so, you must have a way to revoke that certificate without losing all trust in the entire network. In a small home network, as AJ's comment states, it's not a huge deal to revoke the one primary CA certificate and regenerate all the certificates on the network, but in larger networks it can bring the whole thing to a screeching halt.
Typically, redundancy and tolerance to compromise is achieved with multiple levels (at least two) of CAs in your trust chain, much like the globally-trusted CA chain works. There would be one "trusted root" certificate, a "golden key", the public version of which is implicitly trusted by the network machines. The private key is stored on an HSM, and when not generating "public-facing" CA certificates it is kept in a secured vault that requires sign-off from multiple executives to access.
Those "public-facing" CA certificates are the ones used by the PKI server(s) to generate the non-CA certificates issued to servers and clients on the network. Should an attacker compromise one of these CA certificates, that certificate can be revoked (telling all computers not to trust it or any certificate signed by it), and any computer that had a certificate signed by that CA can prove its identity in some other way to the PKI system, and get a new certificate from one of the non-compromised CA certs. Meanwhile, the execs sign off, the HSM is retrieved under the watchful eye of a lot of interested people, and a replacement CA certificate is generated to replace the revoked one in the PKI system.