This only works because the same company is hosting the content (appspot) as the fronting domain (google.com). Google terminates the TLS then looks at the host

This only works because the same company is hosting the content (appspot) as the fronting domain (google.com). Google terminates the TLS then looks at the host header to see where to send it. It can't be hidden behind a random domain.