Mozilla hosts an https tunnel for subdomains that match YOUR-subdomain.mozilla-iot.org where users choose a unique subdomain and a cert for it is auto-installed (using LetsEncrypt) onto the RPi or Turris Omnia during first time setup. In the future once the WebThings Gateway has control over edge firewall rules, then the tunnel can go away in favor of a "hole" for 443 or a port forward rule for https access directly to the gw. Privacy risks are far reduced if we all run our own local smart home gateway in our homes.