> This means we cannot use self-hosted services even using a VPN with official apps without getting a signed cert.

What do you mean by this? Any service that is designed to be self-hosted will have an app that accepts user-installed CAs. HomeAssistant, for example.