I thought .home.arpa[1] was the preferred TLD for internal residential home networks now, not .local

I use my own CA root and individual certificates for each of my internal machines that use TLS.

1: https://datatracker.ietf.org/doc/html/rfc8375