By default, /usr/sbin is not on PATH for non-root users in Debian sid.

So, binaryExists("update-ca-certificates") returns false at:
https://github.com/FiloSottile/mkcert/blob/master/truststore_linux.go#L49
and mkcert fails to install in the system store (Installing to the system store is not yet supported on this Linux).

Simply running

PATH=$PATH:/usr/sbin mkcert -install

solves the issue, but it would be nice if mkcert could temporarily add /usr/sbin to PATH or search in it explicitly.