On: Just want simple TLS for your .internal network?

[yjftsjthsd-h]

Can't any client on the same wifi read your traffic by just putting their wifi card into promiscuous mode? Obviously depends on who uses your wifi and your threat model, but that seems like a problem.

[NotPractical → yjftsjthsd-h]

Yes, on WPA2. WPA3 introduced per-client encryption keys.