What bugs me is that whatever solution you'd want to use requires two SSL certificates and with that, at least two distinct IP addresses.

Especially the latter is concerning considering we are running out of addresses.