In our company we have an internal CA certificate for signing various things including the proxied (MITM'd) HTTPS connections.
Suppose we use this CA to sign a key for "localhost" for use in automated testing (so we don't have to mess about with custom Firefox profiles). This key would be distributed to the developers, probably by checking it into the source repo.
What are the dangers of this approach? Suppose an attacker stole the key, and could then sign localhost HTTPS. What could they do?