This sounds great acually. Browsers should only trust them when connecting to local IPs (based on subnet or something), is displayed as a gray padlock that says

This sounds great acually. Browsers should only trust them when connecting to local IPs (based on subnet or something), is displayed as a gray padlock that says "Local", the ACME endpoint should be restricted to only giving out certs on specific domains (.local or something), and to reissue any cert with the same name as a previous cert the device has to prove that it's the same (unique embedded public key or something). Maybe an exception that devices can always get a local cert for its IP, and the owner of the ACME device can assign "pretty" names to "unique" names on a case-by-case basis. The thing issuing DHCP leases has full control over your ability to connect to the internet anyways, so around here seems like the right place to put it. My only qualm is that I trust router manufacturers to implement this correctly about as far as I can throw a sheet of paper.