LAN-only SSL certificates should be possible, in theory: buy a domain, set up deviceX.example.com to resolve to a LAN address, get an SSL certificate from LetsEncrypt using DNS verification.

Expecting every smartbulb user to do this kind of system administration is a bit unreasonable.