Ack on the simplicity part and not needing to talk to the server after the first load. But the main concern is that stuff could simply be injected on that first load.

Depending on how you host, the easiest solution might be to use the caddy web server which has letsencrypt built in.