Then why use encryption at all when your threat model for encrypted communication can't handle a malicious actor on the network?
(Though getting the browser to just assume http to local domains is secure like it already does for http://localhost would solve that)
Then why use encryption at all when your threat model for encrypted communication can't handle a malicious actor on the network?