I don't think real certificate provider could work with .local mDNS address as they need to do some public verification going on the second answer is, ssh -L a

I don't think real certificate provider could work with .local mDNS address as they need to do some public verification going on the second answer is, ssh -L are just pretty slow on concurrent request, I might think it's just bloat as there is so much thing happen on ssh that not required for tunneling, also it doesn't do vhost natively as on Lokal you can just choose which domain you want to use, and it's just works...