Couldn't you bind localhost.yourdomain.com to a public IP, get a certificate, install that certificate locally, then change localhost.yourdomain.com to resolve to 127.0.0.1?
You can even use a DNS challenge and leave the 127.0.0.1 record in place.
Use Firefox. No problems at all here.
Have you checked out https://www.getlocalcert.net/ yet? They're working on adding more login options than just Github, but they're not quite there yet.
If you want a CA you can just make a CA and add it to your trusted certificates.
Not sure if this works for Windows, but the author knows what he is doing and his technique seems fairly well thought out.
Chrome has an exception for requiring tls on localhost for certain services. That, plus an extension to disable CORS on it has gotten me as far as I've needed (so far). What roadblocks have you come across?