Investigate using self-signed cert for localhost web interface

Using a self-signed cert to enable https on the localhost web interface may protect against malicious packet sniffing on the localhost network. Before this didn't matter because you need root to do that, and root could access the unencrypted wallets anyway. Now that wallets are encrypted, this is a potential attack route. The risk is similar to a keylogger.

Shipping a self-signed cert and key with the backend would be pointless since the attacker could use the key to decrypt the traffic anyway.

It may be possible to generate a self-signed cert in memory each time the backend is run, and share the cert with the frontend. Electron will not trust it by default so we could intercept the failure and possibly validate it ourselves. Determine the extent to which we can validate it. See: https://stackoverflow.com/questions/38986692/how-do-i-trust-a-self-signed-certificate-from-an-electron-app

However, while electron can force the self-signed cert, running the page in the browser can't, so this would only help with electron.