And if a user doesn't have any issue with it: C) user accepts the usage of a private CA which they need to install on every client.
You could always offer it ![]()
Also note that if you offer the user to fetch a Let's Encrypt certificate, it needs to be able to fetch the challenge token through one of the officially mandated ports: 80 (http-01 challenge), 443 (tls-alpn-01 challenge) or 53 (dns-01 challenge, so using DNS). You can't only open port 8080, as that port is not allowed.