PEAP can still require a trusted server certificate -- getting set up with MDM is a pain, and scaling by hand is also a pain, but you can (and I do) set up my devices to require a specific valid SAN on the RADIUS connection. No extra certificate trust required, if the RADIUS server has a certificate that chains up to the default trust store.
I remain disappointed that there's no standard mechanism for mapping between an SSID and a domain name to know which SAN to trust.
I remain disappointed that there's no standard mechanism for mapping between an SSID and a domain name to know which SAN to trust.