You can do the signing on the phone (though there is some nuance here as logging in to the account is hard and the techniques used by AltStore involve injection into other Apple software; this is at least theoretically fixable, but does mean that it wouldn't be trivial), but you can't do the installation from another app on the phone in any obvious way (at least without restricted entitlements). AltStore is acting like Xcode doing over-the-network installs from AltServer (and then also happens to do the signing there, but that's again simply to make it easier to develop it).

AltStore is based on the signing code I developed and also used in my Cydia Impactor (which lets you install apps over USB); I actually did develop another tool called Cydia Extender, which would run on your phone, but I dropped the effort when I couldn't get stuff to install on the phone (the technique I came up with relied on an entitlement that was only able to be installed by users with developer accounts; I even somehow failed to notice this until after I released it, which was awkward: I still can't believe I messed up my testing that badly). (Actually... maybe I have a way to pull this off now? It is a long shot, and somewhat risky ;P.)

Could you use a VPN on the device to make a remote server appear as a local server for network installs? If so, could you loop back an on device “server” through a remote proxy?

So, this is actually how Cydia Extender "worked" (aka, "failed" ;P)--though I wasn't using the Xcode protocol but instead did an ad hoc install (which turned out to also separately not work for non-developer signed IPA files, TWO issues I had failed to notice before release ;P)--but Apple restricts usage of the Network Extension (VPN) API using an entitlement only available to paid developers (which I will strongly assert is to help the CCP's censorship of Chinese citizens as part of Apple's continual unfortunate collaboration). (I now happen to work on semi-programmable VPN tech that is in the App Store, so I might have options; a bit risky, though ;P.)

AltDaemon [1] runs on the phone and does this - it does require a jailbreak however.

[1] https://repo.dynastic.co/package/altdaemon