The same thing happened to AVM recently, who make a popular (in Germany) series of home routers that assign <hostname>.fritz.box hostnames to devices by default. `ssh foo.fritz.box` would conveniently work – until .box became a registerable TLD and somebody snatched fritz.box and directed it somewhere else, concerningly also running SSH...
Arguably that's on them, but .lan seems much more controversial and I really hope ICANN does the right thing here and at least declares it permanently reserved/non-registerable.
Once that happens, browsers and other stakeholders could then consider allowing self-signed TLS certificates, maybe with TOFU semantics, for .lan hosts, ideally together with .local mDNS ones.
Arguably that's on them, but .lan seems much more controversial and I really hope ICANN does the right thing here and at least declares it permanently reserved/non-registerable.
Once that happens, browsers and other stakeholders could then consider allowing self-signed TLS certificates, maybe with TOFU semantics, for .lan hosts, ideally together with .local mDNS ones.