Okay, re: my local pairing suggestion, nevermind. I didn't think it through properly. Won't work.
Also: it seems that the "Safari can't open the page because it could not establish a secure connection to the server" message is not related to the self-assigned certificate. I toyed around with
Telekinesis, which also uses a self-assigned cert, and it lets me in just fine after accepting a warning. Must be something else.