A year or so ago I wrote IPFS-boot which allows serving webapps on IPFS while providing also an update path and without breaking content hashing:
https://github.com/rhodey/IPFS-boot
But now if you want to serve a secure webapp and not use IPFS IMO the only option you have is to tell users to install Tailscale and to host the webapp themselves and then to install Tailscale on all devices.