If someone can intercept traffic to your server IP, they can get a Let’s Encrypt certificate. If they can’t reliably man in the middle that IP, then HTTP is reasonably secure already.

Such “certificates without certification” This is one reason browsers have added new UI elements for certified domains.