KOReader is by far better than the crappy stock firmware from Kobo. While the interface is not the prettiest, it still has a lot of advantages :

• it adds the ability to browse the filesystem (how do people use an e-reader without folders ?)
• loading medium to large PDFs takes ages in kobo’s stock UI, while it’s almost instant in koreader
• there are a bunch of plugins you can add to koreader

While I really hate Kobo’s stock UI, I still recommend getting one if you like truly owning your hardware. It’s really easy to enable ssh access and then it’s just regular Linux. It’s even possible to run an X server and launch Linux graphical apps on the e-ink display (not quite usable though)

Having a certificate for any subdomain has implications for other sibling domains, even without a wildcard certificate.

By default, web browsers are a lot less strict about Same Origin Policy for sibling domains, which enables a lot of web-based attacks (like CSRF and cookie stealing) if your able to hijack any subdomain

I did not have the money to pay the insane amounts these greedy for-profit certificate authorities asked, so I only remember the pain of trying to setup my self-signed root certificate on my several devices/browsers, and then being unable to recover my private key because I went over the top with securing it.