A zone under .localhost has no public DNS, so no ACME challenge can complete for it. didbot_tls::local keeps an authority in a directory of its own, one per machine, signs a zone-and-wildcard leaf under it and reuses both on later starts; didbot_tls::source is the one table deciding which authority a zone may use, so ACME and this can never both apply. The authority carries a name constraint permitting only localhost and what sits under it, so a developer who trusts it has trusted nothing else. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Change-Id: I25c5772eb930dde9f580b63fcf93164ebbf8c56e