I'm thinking of a mechanism where the router obtains a trusted cert automatically, like Plex does (
https://blog.filippo.io/how-plex-is-doing-https-for-all-its-...), and then asks users to authenticate by password over TLS before allowing access to network resources.