all you need is a certificate on the device and an app in the app store. or an installer they can download to their computer. you don’t need a full on traditional CA. you just need to verify (one) certificates.

sign the certificate in the manufacturing plant and put it in the coffee maker l. give the CA cert out in the app or the installer. now you can verify if the coffee maker talking to you over HTTPS is legit and probably get it’s serial number off the cert too. your CA keys never see the public. you could go even more secure and use that as a bootstrap to a per customer CA and generate a new cert on install, but this is a coffee maker right?

What app store? Which OS? Do you now suddenly have to write software for all OSes to install the certificate? Something that you didn't even have to think about doing before. The entire reason you went for a webui to begin with.

this is only in the pure local no internet case. with internet it’s a no-install plug in and done

you don’t need to install any certificates in any case. the server just needs to validate the client is well signed

User's webbrowser is visiting the appliance which resides on LAN. Webbrowsers require certificates signed by a CA.

i think you are misunderstanding the IoT flow. you don’t connect to devices

That is a generalization. You certainly do with many networked appliances. And I prefer this, since that means connectivity with the device is not dependent on some cloud service. And that some cloud service can't control my appliance.