Browsers barf at non https now. What are we supposed to do about certificates?

You can set up your own CA, sign certs and distribute the root to every one of your devices if you really wanted to.

That sounds like a bad idea, you would need your CA and your root certs to be completely air gapped for it to be even remotely safe.

What if I told you, businesses routinely do this to their own machines in order to make a deliberate MitM attack to log what their employees do?

In this case, it'd be a really targetted attack to break into their locally hosted server, to steal the CA key, and also install a forced VPN/reroute in order to service up MitM attacks or similar. And to what end? Maybe if you're a billionaire, I'd suggest not doing this. Otherwise, I'd wonder why you'd (as in the average user) be the target of someone that would need to spend a lot of time and money doing the reconnaissance needed to break in to do anything bad.