You can probably automate this actually. There are several domains you can subdomain on afraid (or better yet the router manufacturer / nas manufacturer / camer

You can probably automate this actually. There are several domains you can subdomain on afraid (or better yet the router manufacturer / nas manufacturer / camera company etc should be providing a subdomained address per device) and then get issued a cert for (letsencrypt uses the public suffix list to remove rate limiting from some of the afraid domains mentioned before, and any company interested should get their catchall domain added to that list). Then it just comes down to doing the same redirects / hsts policy for insecure connections, but I believe they would have to be done at the root domain level, again going back to manufacturers providing them. The letsencrypt part itself is the easy part, the hard bit is getting the domain name to register under. All the good open source router firmware today already supports Dynamic DNS. All that being said, every Internet of Things device made is a security nightmare and none of the manufacturers give a damn, so they will never see a reasonable expectation of security or do anything like this. They cannot even produce a common OS amongst themselves to keep their firmware up to date and free of security vulnerabilities.