Getting ready to issue IP address certificates

This is incredibly dumb. The three way handshake and initial key exchange is your certificate.

That would be fine if browsers didn't throw up giant warning signs when using self-signed certificates.

And this protects you from a hostile network how?

How does the certificate? If you already have to do the TLS handshake it doesn't change anything.

That sounds like a defect in the browser design.

Or maybe it's because you actually want an identity to verify (which an IP address is not.)

Usually you can just import the leaf self signed cert as a CA in your OS trust store and the problem goes away (assuming it has an IP SAN). Slightly tedious but you can issue the certs with long validity

A verified certificate lets you know you didn't handshake with an attacker in the middle.

Let me rephrase that: How is the CA supposed to know they didn't handshake with an attacker? All they have is the IP, there's no identity to check like with DNS.