On: DNS over HTTPS

[dyu]

You can remember a small set of resolved hosts for this purpose, not unlike remembering DNS servers or CAs to trust. A quick search online also says it's possible to issue a cert to a public IP address, so you can also do HTTPS to a numbered IP instead of a host name.

[tzahola → dyu]

I haven't heard of any respectable CAs that would issue certs for IP addresses...

[tialaramex → tzahola]

They're rare but they do exist. The CA needs to ensure you really have long term control over the address.

Most people would never need one, but a few people have a real use for them.