Yes I agree. But I see that as an exception. The Captive Portal is ONE thing that needs to be secured and be accessible inside the LAN of a public wifi hotspot. I see that as a special case, and public HS providers can work around that (using a domain for the CP they own and got a cert for). But imho that does not mean that browsers should throw security warnings at users for everything else inside their home lan. At least until we have a solution that works for everyone. And

- depending on an external service for your internal home stuff, or

- installing a self signed CA on every device you own

is not a solution.

Until we have something we can replace the status quo with, we should not deprecate it.