Do you want to put a web page on a .local address to do something cool for your household or club? Here's the list of browser features that browser vendors have decided you're just not fuckin' allowed to use. https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Secure_Contexts/features_restricted_to_secure_contexts
Some random site halfway around the world, served over https with a robo-verified certificate, is allowed, though, so take some comfort in that.
There's a discussion thread about allowing RFC 1918 addresses and their ip6 equivalents to participate in secure contexts at https://github.com/w3c/webappsec-secure-contexts/issues/60 . It is _eight years_ old without resolution.
I can't find any discussion at all on allowing the user to designate certain origins as secure contexts. Maybe that's a thing for some browsers.
As proposed here which is continuing on from w3ctag/design-principles#75: It should be possible for people to create devices that are located on home networks that use modern browser features. One ...
@jima @ryanc @owen Yep, that's the right way to do it.
Prior to DNS-PERSIST-01 announcement, I had an even fancier plan in the works: delegating _acme_challenge to a public server (run as a public service) with a DS whose key is held by your device that wants certs. When you need to do the ACME dance, the device would send a DNS packet to the public service, which would cache and serve it for up to some short time limit.
I never got around to implementing it, and once DNS-PERSIST-01 was announced, I dropped the idea because it's no longer needed.
Owen
Ryan Castellucci (they/them) 
Cassandrich
Jima 
Haelwenn /элвэн/ 
Paul Martin