The point is, it's also outside the reach of the public internet, so you can't get "proper" HTTPS anyway (unless you get a custom root CA). I fail to see the da

The point is, it's also outside the reach of the public internet, so you can't get "proper" HTTPS anyway (unless you get a custom root CA). I fail to see the danger added in making this ip "Secure". Suddenly, a MITM-ing actor could modify the responses to do some webrtc and ask the user for his geoloc. I don't think it's that much more dangerous. And let's not mention the fact you can get a free HTTPS with let's encrypt, MITM an existing 10.0.0.X connection and serve a 301 to your https-enabled domain name. My use-case is rather simple : I host a few things at home, and I've had to install a root CA on every device just because I can't do webrtc otherwise. I could get a letsencrypt certificate for a domain name, but honestly that sucks.