The problem is that the address associated with a publicly trusted cert _has_ to be universal. We can't give users certificates for `https://192.168.1.1/` https

The problem is that the address associated with a publicly trusted cert _has_ to be universal. We can't give users certificates for `https://192.168.1.1/` https://192.168.1.1/` or `https://my-router.local/` https://my-router.local/`, because then attackers could get certs for those names as well, which would defeat the whole purpose of HTTPS. DNS is well suited for allocating unique, memorable names to devices, but, as you said, it _does_ rely on third party services (registrars, at the very least) to operate. If we don't want to rely on third party services, we'll need to come up with an alternative to DNS that accomplishes the same goals.