> What are free sites that give every user a subdomain for their profile/site/etc supposed to do?

Couldn't you include an ACME request for a new subdomain certificate into the "create account" script?

This would certainly add some complexity (especially with automatically fulfilling the "proof-of-ownership" challanges and properly renewing all the subdomain certificates) but it seems doable with less running cost than a wildcart cert subscription.

Edit: On second thought, this does leak some interesting data to the CA - such as, how many users you have, what their usernames are and how your rate of new signups is.