AWS ACM is free-as-in-complimentary-peanuts, and I'd bet they could handle a pretty big chunk, although 2000rps for a request that's calling external services and cryptographically signing things is a bit intimidating.
That's only viable if you're using AWS's load balancers or CDN, though.
You can also use ACM certificates directly on nitro-powered EC2 instances too