Much later update on Home Assistant: the new version DOES have TLS support in the built in web server now, making half of my previous whining absolutely mitigated. We might even live to see the console being being behind some form of login in this lifetime!