Regarding other gotchas, don't overlook (from OP reference):
What traffic should be bypassed?
Administrators should consider bypassing business-critical applications that use certificate pinning, destinations that fail during inspection, and any traffic excluded for privacy, regulatory, or operational reasons.
Rember, this is basically a man-in-the-middle "attack".
Nor:
Supported TLS 1.3 traffic can be inspected, but TLS 1.3 sessions using Encrypted ClientHello (ECH) are bypassed rather than decrypted.
Basically, your going down the path, somewhat, like recording all phone communications or placing cameras in company provided rest rooms. I.e. sometimes you need to consider legalities beyond what's possible technically.
From a security viewpoint, if you're concerned about what might be exchanged via HTTPS, what about flash drives and personal cell phones?
BTW, I'm not discounting the issue, just sometimes folk don't appreciate the full picture nor considerations beyond the technical.
As engineers, further recognize your employer may tell to do something that's actually illegal and the fact you, or your employer, are unaware of that, doesn't necessarily protect you.
Over the years, I've been in companies presented with devices to "inspect" encrypted data communications, and whenever I asked for further validation of its legality, the project was dropped.
Again, not saying this should never be done nor it's always illegal, but proceed with care. If nothing else, it can cause bad will with employees. So, just a possible "gotcha" besides concern about performance impact.
