Presumably you'd choose a different port but then it'd be pretty obvious you're running something if your server has a random HTTPS server exposed on port 444 or whatever.
nginx exposed on 443:
if route is /web then route to web service on port 1234
if route is /ssh3-secret-string -> route to ssh3 server service on port 1265
if route doesn’t exist then 404
…
If so, I assume the encryption on the SSH is handled separately from the http headers.
Since 1.25.0
[for instance, I run Kestrel and it really isn't designed to target more than one site; I do it, but it's like bending that Lego brick to make it fit where it shouldn't go]