I think we took a left turn midway between my comment and your reply. You asked how people should handle universal TLS for internet-disconnected systems. The a

I think we took a left turn midway between my comment and your reply. You asked how people should handle universal TLS for internet-disconnected systems. The answer I gave addressed that directly: there are commercial and open source tools for doing so (MSCA, Vault, EJBCA, smallstep, FreeIPA, to name a few). But the overwhelming majority of actual individual users do not desire to segment their IoT devices off the internet. That’s not a “fallacy”, that’s just a fact. It’s clear that you have objections to the current state of general purpose computing, and desire that technology existed differently. But that’s a pretty far step away from the topic here.