Every other product I can think of (Proxy.app, MITMproxy, and so on) also uses self-signed certificates generated at startup / configuration time rather than a shared root - I think that design is unique to Charles.

Charles does allow you to use your own certificate, but it's not the default user flow.

I see the ease-of-use case for the way Charles does it, but the shared-certificate approach is so insecure (you're basically handing the keys to all of your unpinned SSL traffic to anyone on the Internet) that I wish it would go away.

I also really like Fiddler and the warnings it provides are excellent. Sadly, it doesn't really support OSX yet so many iOS developers can't use it.

I also found it hard to set up Charles to use a custom cert, definitely had to read the instructions on their site instead of trying to figure it out on my own.

A very awkward way of using Fiddler from OS X would be via a Windows VM that had Fiddler set up to allow connections from other machines.