[Sohcahtoa82]

If you have a domain that you can control the DNS of, you could temporarily stand up an internet-facing server for localhost.yourdomain.com, get a certificate, then change the DNS to localhost.yourdomain.com to 127.0.0.1 (or put it in your HOSTS file), then address it with localhost.yourdomain.com rather than just localhost.

But yeah, I think really, browsers should be able to allow self-signed certs for localhost.

[jabbany]

Let's Encrypt also allows you to do DNS based validation (DNS-01) where you just set a TXT record on the domain and update it from time to time.

The acme.sh script actually supports quite a few providers so you can cron it up and never even have to run an out-facing HTTP server. Useful for if say your ISP blocks port 80 or if you're behind a NAT you cannot control.