I'm not proposing this for everything and high security public facing contexts can definitely do the maintenance to manage frequent certificate rotation. I jus

I'm not proposing this for everything and high security public facing contexts can definitely do the maintenance to manage frequent certificate rotation. I just don't want my garage door integration with my car to stop working because its certificate broke. I'd argue these privately deployed single use dedicated certificates are actually better off self-signed and issued on a TOFU basis than using public key infrastructure. It's how bluetooth and many other things work, so why on earth are browsers so bent against it.