I would suggest that browsers should support some kind of TOFU for self-signed certificates used by non-publicly accessible web servers.

What if they'd just ask the user to accept and install a certificate when connecting to a local server for the first time?