If you can't trust your network, you'll want encryption, regardless of devices on it.

if you can't trust your network, everything needs to be public internet level hardened anyway, so why not just directly use letsencrypt?

Because you don't want to expose your printer to the public Internet?

Isn’t that what dns challenge can be used for?

Then you need to make your network trustworthy first.

Why?