Without any tunnelling like VPN or TOR, the safest option would be to have several unrelated services share one certificate, when only looking at MITM vulnerabi

Without any tunnelling like VPN or TOR, the safest option would be to have several unrelated services share one certificate, when only looking at MITM vulnerability. This would in theory ensure that any attacker could only assume the client is accessing at least one service on the target machine. Setting aside the obvious risk that one of the services could claim to be one of the others, this obviously comes with some other technical limitations. Again, it's not like the site is doing anything wrong, it just shouldn't be blaming the user for something that's obviously just a technical limitation of the technology being used.