Yeah no, that's where I'd draw the line. I have one nginx instance serving my blog and various resources via proxypass (nextcloud, grafana, icinga, kibana etc.). For the sake of keeping things maintainable, there's one wildcard cert for my domain and one global SSL configuration. I'd rather shut out people with Windows XP than enabling < TLS 1.2 globally.