I get what you are saying. But managing a .local domain is way harder to get right (Your internal CA, certificate house keeping on all kinds of devices and soft

I get what you are saying. But managing a .local domain is way harder to get right (Your internal CA, certificate house keeping on all kinds of devices and software running on them, your internal websites talking to an external IdP, VPN and DNS...). Especially when dealing with corporate bureaucracies -- If you don't have skilled engineers to manage .local, then just purchase a real domain and get public CA signed certificates. There will be fewer things that can go wrong.