Congratulations to the team on this release! I switched to haproxy for load balancing our production traffic 5-6 years ago and it's proven incredibly reliable. Creating a ticket to update our dev & staging environments to 2.7 right now.
I too have fought nginx on upstream health checking and have avoided the cost of Nginx Plus. I'd love a good alternative, but we have a number of lua plugins we depend on for rate limiting, metrics, auth, etc.
I do have an haproxy setup that does the right thing with LetsEncrypt, but it's just a path-based forwarder that works with an acme script on the system, not directly built in.