I don't think that the fact that private keys for routerlogin.net are bundled with the router are an issue.
It's very logical to do so, and BETTER than plain HTTP in most real-life scenarios.
routerlogin.net is a local server (when you are using the router) and not a remote website so it's expected that you can trust the content as much as trustable your local network is.
but this requires internet access so barely a solution. https://engineering.fb.com/security/delegated-credentials/
I don't think that the fact that private keys for routerlogin.net are bundled with the router are an issue. It's very logical to do so, and BETTER than plain HTTP in most real-life scenarios.
routerlogin.net is a local server (when you are using the router) and not a remote website so it's expected that you can trust the content as much as trustable your local network is.