Thanks a lot for the reply. I did set up a CA. Maybe that's different from "self-signed," but I used mkcert to create a CA and install it. I then added it to the Keychain and set it to "always trust" for all applications.
I also used mkcert to generate server certificates for localhost and the name of my computer on the local network.
I did get the CA onto a simulator by uploading it to a Web server and then hitting it by URL in the simulator's Safari. I have it installed on the simulator, and I confirmed that its serial number matches that of the CA on my Mac.
But the certificate is still flagged as "invalid" when my application tries to hit my server at localhost... Aha, looking at your comment again and assuming you noticed I said iOS 17... I went back and looked in the settings area you mentioned. Sure enough, there is now the Trust switch there, and it was off.
It's some bad UI to scatter these certificate functions between "VPN and Device Management" and "About." But your comment clued me in, so now it works!
The CA remains shown on "VPN and Device Management," by the way; it's not the blank screen that bounces out anymore. In case that's useful to you.
Thanks again.