I just bought mysefl a '.casa' domain, got wildcard cert for it from lets encrypt and haven't bothered with any of these. Downside, if internet goes down resolver stops, but thats why I have local NS mirror and all DNS queries go through my resolver.
Another downside is that some devices these days use their own encrypted DNS resolver and fall back to local DNS only for non-public TLDs. Not sure if that will continue working then as expected if your internet connection goes down.
I've been bitten by this with my home router which uses <device>.fritz.box when somebody registered fritz.box.
You can buy a cheap domain to make sure no one else uses it and just roll it on your lan. Throw some DNS ACME challenges and you have valid certificates too.
I do it for the LE certificate. But "cheap" is subjective. Domain registration and management should not be as expensive as it is. Nothing the registrar or registry does could be worth $8/10/200 a year with guaranteed 5-10% price increases every year. It is a grift.
.home.arpa is so clunky. Why do I have to put the acronym of a US military project in my domain to access resources on my own local network?
Yes, I know that organization was central to the development of the l Internet, but it's not relevant as a domain 40 years later.