I agree, though instead of "public key" I would just say "self-signed cert". > ...or you could simply treat HTTP in local networks as a secure origin and be do

I agree, though instead of "public key" I would just say "self-signed cert". > ...or you could simply treat HTTP in local networks as a secure origin and be done with it. I think this is a lot harder than it sounds. What's a "local network". Is a coffee shop or public wifi a local network? How does the browser know? How do you know a rogue IoT device isn't doing ip spoofing?