If that's all you want to accomplish, you don't need WebPKI. Just generate a private key and a self-signed certificate.
(This is basically how Let's Encrypt / ACME accounts work)
(This is basically how Let's Encrypt / ACME accounts work)
That's how they're implemented. How they "work" is a trivial pushbutton thing as documented by a well-known and trusted provider who cares deeply about simple user experience.
"Just self-sign a cert" is very much not the story XMPP wants their federated server operators to deal with.
There's DANE but outside of maybe two countries that's impractical to set up because DNS providers keep messing up DNSSEC.