To me the cleanest solution would be to have something ACME like coupled with DHCP and/or 802.1x (or something like that) that would allow routers to advertise

To me the cleanest solution would be to have something ACME like coupled with DHCP and/or 802.1x (or something like that) that would allow routers to advertise a) CA certificate applicable to local network only b) A place where hosts can (semi-)automatically get CSRs signed. Of course practically that seems very difficult to get actually landed, especially as it is somewhat complicated to make sure that rogue routers can not somehow impersonate any external hosts.