Then why use encryption at all when your threat model for encrypted communication can't handle a malicious actor on the network?

(Though getting the browser to just assume http to local domains is secure like it already does for http://localhost would solve that)