Right, yeah, browsers are not guaranteeing any security on the local network.

If self-signed is not an option, then I think an internet connection and domain name are required. (Which seems to me is totally fine. That's the whole point of IoT)