I would suggest that browsers should support some kind of TOFU for self-signed certificates used by non-publicly accessible web servers. What if they'd just as

I would suggest that browsers should support some kind of TOFU for self-signed certificates used by non-publicly accessible web servers. What if they'd just ask the user to accept and install a certificate when connecting to a local server for the first time?