Out of curiosity, have you thought about registering neocities.org as a Public Suffix? Aside from bypassing the rate limits, neocities.org seems like it would b

Out of curiosity, have you thought about registering neocities.org as a Public Suffix? Aside from bypassing the rate limits, neocities.org seems like it would belong on the list, given that you're (more or less) delegating control over subdomains to other parties. The PSL has implications for cookie scope as well (which might or might not be a concern for you). I would very much like to see wildcard support in ACME and hope that Let's Encrypt will adopt it eventually (although I think clients should offer it as an opt-in, as not to encourage practices which are bad for security), and I think that both of your examples are a good fit for wildcard certificates. I'd probably still stick with a regular wildcard as well - $100/yr vs. managing ~1k+ SAN certificates sounds like a bad trade-off - but I thought I'd mention it anyway.