In general, we try to make http://localhost a valid choice for operating services in browser APIs, if only because that enables testing.

Right now, the specification explicitly rules out localhost, largely just because it isn't generally accessible using HTTPS. Should we take special steps to accommodate testing, or can we instead ask that people use self-signed certificates for testing this API? What other alternative approaches could we take?