I think that requiring world-visible TLS certificates for LAN-local web services compromises the privacy of the infrastructure I run in my bedroom for my own usage.
It exposes part of the domain, but none of the services.
If you want to be even more secure, you could null-IP the wildcard and only allocate IPs for subdomains that you use.