You can just issue new certificates one per year, and otherwise keep your personal root CA encrypted. If someone is into your system to the point they can get the key as you use it, there are bigger things to worry about than them impersonating your own services to you.
I ran out of crtcs, but I wanted another monitor. I widened a virtual display, and drew the left portion of it on one monitor, like regular. Then I had a crown job that would copy chunks of it into the frame buffer of a USB to DVI-d adapter. It could do 5 fps redrawing the whole screen, but I chose things to put there where it wouldn’t matter too much. The only painful thing was arranging the windows on that monitor, with the mouse updating very infrequently, and routinely being drawn 2 or more places in the frame buffer.