I hate all of these well intentioned ideas, just like I hated when apple forced <1 year certs. All of this is in service to online devices, and completely screw

I hate all of these well intentioned ideas, just like I hated when apple forced <1 year certs. All of this is in service to online devices, and completely screws devices intended to operate over lan only. I find security and peace of mind by blocking a devices access to the internet, but these changes mean that every single trinket that talks over the lan needs a whole boatload of suspicious looking internet traffic. It also makes it so you can't operate devices in offline networks. (this is already a thing due to apple's cert changes)