Other people have mentioned setting up internal CAs - but for most folks this isn't a realistic option as things stand.
If future home routers came with CA functionality built in and somehow automated the process, that could work.